Malicious code in hunimiabai-satiab-nabaib (npm)

Source: amazon-inspector 8e044503a1ae915649bf685a95fa86a0755b5b2f7c2c8f985b20001e00a98dbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hendra-klipo16-miaww (npm)

Source: amazon-inspector d6c0ee401db3abbd54b237c350dff18aaa01524b50bdaafa0f54e9ea2f85aa2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hadi-lutis18-riris (npm)

Source: amazon-inspector 43ecfe7b3afd481a6d282bd0a13fa799171aafc509dec512d1fb544e496c3037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2024-000296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-000296 advisory. A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification...

EUVD-2026-76836

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-11355 DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-11355

The DT LMS – elearning WordPress plugin (versions ≤ 1.1) is vulnerable to unauthorized modification of plugin settings due to missing capability checks on multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings). These handlers are registered on the ...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-84023

The BEAR - Bulk Editor and Products Manager Professional for WooCommerce WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.2.2 . The root cause is a failure to verify a CSRF nonce or check user capabilities when updating taxonomy terms. An attacke...

WordPress BEAR plugin < 1.2.2 - Taxonomy Term Modification vulnerability

Taxonomy Term Modification vulnerability discovered by Ali Mousavi in WordPress Plugin BEAR versions 1.2.2...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

EUVD-2026-76812

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-11355: Missing Authorization

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-89672

A flaw was found in the Linux kernel's Network File System NFS server daemon nfsd. When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List ACL or both access and default ACLs. This occurs because the setposixacl function ...

CVE-2026-90454

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90454

A read-only deployment mode for a product with a bundled packet-analysis component (per the CISA ICS-CERT advisory reference) uses a pattern-based deny list to block write-capable routes, but the pattern omits routes that modify tags on stored session records . Since the proxy otherwise permits t...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...