@crabnebula/taurify-api (>=0.1.0, <=0.1.3), @huakunshen/kunkun-ip-info (0.0.7) +8 more potentially affected by CVE-2026-95625 via @tauri-apps/plugin-updater (>=2.0.0-beta.3, <=2.10.1)

@tauri-apps/plugin-updater NPM version =2.0.0-beta.3, =0.1.0, =0.0.1-alpha.0, =0.0.2, =0.2.33, =0.1.1, =0.0.2-alpha.0, =0.0.2-alpha.18 - kksh 0.0.23 - kunkun-ext-letterboxd 0.0.3 Source cves: CVE-2026-95625 Source advisory: SNYK:JS-TAURIAPPSPLUGINUPDATER-20081664...

Improper Verification of Cryptographic Signature

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the verifysignature function in updater.rs, which does not validate that the version embedded in the signature's trusted comment matches the version...

Improper Authorization

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Authorization via the allowDowngrades option exposed to the frontend JavaScript API, which allowed any web content running inside a Tauri application to request installation of an older, previous...

@crabnebula/taurify-api (>=0.1.0, <=0.1.3), @huakunshen/kunkun-ip-info (0.0.7) +8 more potentially affected by CVE-2026-95624 via @tauri-apps/plugin-updater (>=2.0.0-beta.3, <=2.10.1)

@tauri-apps/plugin-updater NPM version =2.0.0-beta.3, =0.1.0, =0.0.1-alpha.0, =0.0.2, =0.2.33, =0.1.1, =0.0.2-alpha.0, =0.0.2-alpha.18 - kksh 0.0.23 - kunkun-ext-letterboxd 0.0.3 Source cves: CVE-2026-95624 Source advisory: SNYK:JS-TAURIAPPSPLUGINUPDATER-20078986...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...

EUVD-2026-45315

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

EUVD-2022-25071

Malicious code in bioql PyPI...

Cross site request forgery (csrf)

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check...

CVE-2022-1791

The CVE refers to the WordPress plugin One Click Plugin Updater, affected ≤ 2.4.14, which lacks CSRF protection when updating settings. The root cause is missing CSRF checks, enabling a logged-in admin to alter settings via CSRF and disable/hide the updates badge and related checks. Exploitation ...

CVE-2022-1791: Cross-Site Request Forgery (CSRF)

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check...

PT-2022-14115

Name of the Vulnerable Software and Affected Versions One Click Plugin Updater WordPress plugin versions 2.4.14 and earlier Description The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could...

WordPress plugin One Click Plugin Updater has a cross-site request forgeing vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress One Click Plugin Updater plugin <= 2.4.14 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress One Click Plugin Updater plugin versions = 2.4.14. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is...

One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check. document.getElementById"test".submit;...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Multisite Content Copier/Updater plugin...