CVE-2026-16608

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

MAL-2025-64319 Malicious code in military_donkey_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b5371d6708a862fc14326c9a51dcdc20458fa005b2299643d6a0354f595e3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...