MAL-2026-7064 Malicious code in @dany47/csec-form-helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7060 Malicious code in @cashback/postal-premium (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7050 Malicious code in @bmg-web/bmg-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7049 Malicious code in @athena-ui-components/utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7048 Malicious code in @athena-ui-components/user-activity (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7045 Malicious code in @athena-ui-components/lang (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7043 Malicious code in @athena-ui-components/helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-9260 Malicious code in wandsdock7wre22fossil (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aiwdeynkjctd (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1602 OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the certmanager.py. component...

ROOT-APP-NPM-CVE-2021-23358 CVE-2021-23358 in @rootio/underscore - Patched by Root

Root has patched CVE-2021-23358 in the @rootio/underscore package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-35213 CVE-2026-35213 in @rootio/hapi__content - Patched by Root

Root has patched CVE-2026-35213 in the @rootio/hapicontent package for Root:npm. Multiple fixed versions available...

MAL-2026-10655 Malicious code in @pimy-b2cweb/apiclient-b2cweb-r2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e81b01be81080333f758249c9b2b33eea63eff7eb1d10c62c6b42288e99a227 The OpenSSF Package Analysis project identified '@pimy-b2cweb/apiclient-b2cweb-r2' @ 99.99.99 npm as malicious. It is considered malicious...

Malicious code in @higherlogic/ocfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bbd559291bd6c2d7889aebe011bb43bef61938171904f5c9ff378f33fd9e5e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chai-spycore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb99516f251bbd13baae5273239a6a04acefea76ddf1a7b06f4b5a328339dae Package republishes the chai-spies Chai plugin source verbatim including original author header under the near-identical name chai-spycore...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

EUVD-2026-42011

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277

The CVE-2026-12277 vulnerability affects the WordPress Frontend File Manager Plugin (through version 23.6). It describes an improper validation of a file path derived from user input when deleting a referenced file, enabling unauthenticated users to delete arbitrary server files (e.g., wp-config....