CVE-2026-16589 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

PT-2026-69177

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL statement. This occurs through an authenticated AJAX action that lacks authorization and nonce checks...

PT-2026-69178

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privilege...

PT-2026-69179

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privilege...

PT-2026-69180

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privilege...

CVE-2026-16595: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16594: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16590: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16589: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

Fedora 44 : p11-kit (2026-110c1a7742)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-110c1a7742 advisory. rpc: guard against overflow when decoding nested attributes CVE-2026-18938 Only affects 32 bit systems Tenable has extracted the preceding description block...

Malicious Package

Overview streak-map-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

Malicious Package

Overview streak-kit-map is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

MAL-2026-13676 Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +20 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: OSV:GHSA-29G2-3RMR-QM68...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +20 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: SNYK:JS-SVELTEJSKIT-18592743...

Regular Expression Denial of Service (ReDoS)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Accept header processing. An attacker can exhaust CPU resources by sending specially crafted Accept headers, potentially leading to...