OS Command Injection

9router is vulnerable to OS Command Injection. The vulnerability is due to improper handling of the sudoPassword parameter in the unauthenticated POST /api/tunnel/tailscale-install endpoint, which is passed to a sudo -S sh process without authorization checks, allowing a remote unauthenticated...

CVE-2026-13353

CVE-2026-13353 affects the WP Ultimate CSV Importer (WordPress plugin) up to version 8.0.1. The root cause is missing capability checks on AJAX handlers (install_addon, saveMappedFields, StartImport) and exposure of the plugin nonce to any authenticated admin page, which enables a Subscriber+ to ...

CVE-2026-13353 WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for installaddon,...

Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

Malicious code in consumerweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...

Malicious code in mongoose-schema-unique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD an anonymous, mutable, public...

MAL-2026-10176 Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...

CVE-2026-59193

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, ...

Malicious code in buffer-util-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d329e426a3af00dc4cb53c8535a3e53848f09a1b80e561f84f29c77bffe746d7 Package impersonates Feross Aboukhadijeh's widely-used buffer package, copying its author, repository, contributors, and description metadata while...

CVE-2026-59193

Grav CMS is a file-based web platform. Before version 2.0.0, an authenticated admin.super user could trigger a denial of service by uploading a specially crafted ZIP via the Direct Install tool, because Installer::unZip uses ZipArchive::extractTo without limits on uncompressed size, entry count, ...

CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, ...

CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, ...

CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, ...

Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

MAL-2026-10159 Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

MAL-2026-10116 Malicious code in jwtmethod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dbd06d83019ce10a1c0da788fc10633f55f9f6c82058ca6841c4650b5611afb On module load, jwtmethod's decode.js executes a top-level routine that performs an HTTPS GET to https://jsonkeeper.com/b/E69V3 and passes the respon...

SUSE CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

PT-2026-57241

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0 Description An authenticated user with admin.super privileges can cause a system crash or exhaust disk space by uploading a specially crafted ZIP archive via the Direct Install tool. This occurs because the...