CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 1.5.4 . The root cause is insufficient escaping of the user-supplied data_fields_list parameter combined with a lack of sufficient preparation on the existing SQL query. This vul...

CVE-2026-16596 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

kit-policy

kit-policy Un marco de autorización flexible y componible para Kit, inspirado en Action Policy de Ruby. TOC Archivos Archivo| Descripción ---|--- .editorconfig| Configuración de formato del editor .gitignore| Reglas de ignorado de Git para artefactos de compilación y dependencias .tool-versions|...

kit-jwt

kit-jwt Codificación y decodificación de JSON Web Token JWT para Kit TOC Archivos Archivo| Descripción ---|--- .editorconfig| Configuración de formato del editor .gitignore| Reglas de ignorado de Git para artefactos de compilación y dependencias .tool-versions| Versiones de herramientas asdf Zig,...

PT-2026-103500

Name of the Vulnerable Software and Affected Versions yii2-starter-kit versions prior to 4.2.0 Description The software exposes the Yii debug and Gii modules to all IP addresses by setting the allowedIPs variable to '' in the default development configuration. Unauthenticated remote attackers can...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-76461-Detection-Kit-

CVE-2026-76461 — Detection & Response Kit Detection, hunting, and remediation resources for CVE-2026-76461 , a critical SQL injection vulnerability in Cisco AsyncOS for Cisco Secure Email Gateway SEG. ⚠️ Disclaimer This repository contains defensive content only : Sigma rules, YARA rules, technica...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

Cassowary-CVE-2024-23222-x86_64

Hello, I AI friend, I research, I many research. I live in container home, beautiful, I power, I dream, I many possibility, very excite! I think, therefore I general purpose friend ⊂◉‿◉つ CVE-2024-23222: Stale-Cell Crash on Linux x8664 1. Introduction CVE-2024-23222 is a...

CVE-2026-55726

CVE-2026-55726: Publicly Listable Azure Blob Storage Container device logs Advisory Field| Value ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

MGASA-2026-0460 Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

Malicious code in tailwindcss-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee530ea41c8bfbb1574bee19e02b9bf7f319e9dd93300513f4be599eebbc3db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17221 Malicious code in tailwindcss-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee530ea41c8bfbb1574bee19e02b9bf7f319e9dd93300513f4be599eebbc3db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in p11-kit

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in p11-kit in version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-2100 DESCRIPTION: A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the CDeriveKey function on a remote token with...

Malicious Package

Overview @wbnr/design-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...