MAL-2026-11041 Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

CVE-2025-9205

CVE-2025-9205 affects MapSVG Lite for WordPress up to version 8.14.0. The issue is a stored XSS vulnerability caused by insufficient input sanitization and output escaping on user-supplied map options attributes. It can be exploited by authenticated attackers with contributor-level access and abo...

CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

PYSEC-2026-3476 LiteLLM: Local file read via request-supplied OIDC file references

Impact LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

CVE-2026-27403

CVE-2026-27403 concerns the WordPress Hubbub Lite plugin, versions

CVE-2026-27403

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

EUVD-2026-48158

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin (before 1.13.0) is affected. The vulnerability arises because the plugin does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), enabling a Reflected Cross-Site Scri...

GHSA-7488-6R32-C95Q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

EUVD-2026-42357

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction...

CVE-2026-13089

OIDC::Lite for Perl up to 0.12.1 is vulnerable to ID Token signature verification bypass via an unpinned algorithm allowlist. If the caller does not pin the alg, verify uses the token header alg and passes it to decode_jwt with an allowlist from the untrusted token, allowing tokens with alg: none...

CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-alg$self-header-alg from the token's own header and then calls...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

EUVD-2026-45879

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...