233110 matches found
MAL-2026-10693 Malicious code in claude-token-tracker-mcp (npm)
The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell...
MAL-2026-5883 Malicious code in redis-xyz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71aef015c4f0fbe383030f3e610e18f548dec6e38a52b294ef9b6c8da462d07d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-12320 Information disclosure in the Password Manager component
Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
EUVD-2026-37111
Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
CVE-2026-12320 Information disclosure in the Password Manager component
Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
CVE-2026-12320
CVE-2026-12320 affects the Password Manager component in Firefox and Thunderbird. The vulnerability enables information disclosure and is documented with a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, low attack complexity, no privileges required, but user interaction is requi...
CVE-2026-12320
Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
CVE-2026-12320
Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
MAL-2026-5880 Malicious code in nat-ulid (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab95c3f95c377215b7cbd4be6d2cdcc79304910b03a2dcdf08f65da6f1c05f4c The package ships a bundled file at dist/node/payload.js containing several POST call sites around lines 14592, 14621, 14805, 14923, 15805. Pattern...
CVE-2026-47190
A flaw was found in the Cluster API Provider Metal3 IP Address Manager IPAM controller. The controller's ClusterRole granted excessive permissions, allowing full create, read, update, and delete CRUD access to core/v1 Secrets. If the controller pod were compromised, an attacker could leverage the...
CVE-2026-52712
Subscriber SQL Injection in Attendance Manager = 0.6.2 versions...
CVE-2026-39437
Unauthenticated Cross Site Scripting XSS in Min Max Step Quantity Limits Manager for WooCommerce = 5.2.2 versions...
ROOT-APP-NPM-CVE-2022-46175 CVE-2022-46175 in @rootio/json5 - Patched by Root
Root has patched CVE-2022-46175 in the @rootio/json5 package for Root:npm. Multiple fixed versions available...
RHSA-2026:25999 Red Hat Security Advisory: yggdrasil-worker-package-manager security update
Bulletin has no description...
MAL-2026-5877 Malicious code in check-ulid (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea848e496c2022409208a3e4a7d9b364c9437699a15554a5a1ee953d4428f230 check-ulid is a typosquat of the legitimate ulid package README is copied verbatim, homepage and bugs link to github.com/ulid/javascript whose...
CVE-2026-52712 WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability
Subscriber SQL Injection in Attendance Manager = 0.6.2 versions...
EUVD-2026-37049
Subscriber SQL Injection in Attendance Manager = 0.6.2 versions...
CVE-2026-52712
CVE-2026-52712 affects the WordPress Attendance Manager plugin version <= 0.6.2 and is described as a Subscriber SQL Injection vulnerability. The initial documents cite a CVSSv3.1 base score of 7.6 (High) with network attack vector, low attack complexity, and high confidentiality impact, but d...
EUVD-2026-37044
Unauthenticated Cross Site Scripting XSS in Min Max Step Quantity Limits Manager for WooCommerce = 5.2.2 versions...
CVE-2026-39437
The CVE-2026-39437 issue affects the WordPress plugin “Min Max Step Quantity Limits Manager for WooCommerce” (versions ≤ 5.2.2). The vulnerability is an unauthenticated Cross Site Scripting (XSS), described as reflected in Patchstack and corroborated by NVD/CVE listings. The root cause is an inpu...