Malware in orderly-plugin-liquidity-heatmap

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18321 Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

Malicious Package

Overview orderly-plugin-liquidity-heatmap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

PT-2026-125033

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1 Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL...

WordPress Datafeedr Product Sets Plugin authorization issue vulnerability

WordPress Datafeedr Product Sets Plugin versions 1.3.24 and earlier contain an authorization issue vulnerability. This vulnerability stems from the lack of authorization checks on the dfrpsajaxdeletesavedsearch function within the functions/ajax.php file in the AJAX Handlers component. It may all...

VulnCheck KEV: CVE-2025-11452

The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$COOKIE'asgarosforumunreadexclude'' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

Backstage path traversal vulnerability

Versions prior to Backstage 3.9.2 and versions 4.0.0 through 4.0.2 contain a path traversal vulnerability. This vulnerability arises because DefaultCatalogRulesEnforcer compares the original location.target URL with catalog.rules within @backstage/plugin-catalog-backend; the URL reader then...

Improper Mattermost exception handling vulnerability

Mattermost versions 11.9 and earlier, 11.1.9 and earlier, 11.5.8 and earlier, and 11.10.7.0 and earlier contain a vulnerability related to improper exception handling. This vulnerability arises from the failure to validate the length of Zoom chat lines prior to slicing them. Authenticated attacke...

Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain

As large language models LLMs are increasingly integrated into Web search, online recommendation, and intelligent decision-making, the third-party plugin ecosystem centered on model customization continues to grow. Among these, Steering Vectors guide model behavior by intervening in internal...

PT-2026-125899

Name of the Vulnerable Software and Affected Versions Qode Membership versions prior to 2.0.6.3 Description An authentication bypass exists that allows for account takeover via the qode membership check facebook user AJAX action. The issue stems from a typographic error in the qode membership log...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792745817)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792745817 advisory. - A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the...

PT-2026-123153

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps ajax delete saved search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launch...

PT-2026-123340

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

PT-2026-123216

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin init of the file /tmp/upload files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd options leads to unrestricted upload. The attack may be launched...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792804368)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792804368 advisory. - A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the...

CLSA-2026-1792938613 TuxCare security update for gatsby-plugin-sharp (1 CVE)

TuxCare rebuilt gatsby-plugin-sharp to address 1 CVE. Fixed in 2.14.4-tuxcare.1...

emqx-RCE

EMQX Dashboard - RCE This is a malicious plugin for EMQX Dashboard which allows to execute commands remotely. The code in this repository is mostly based on one of the latest releases of the EMQX plugin template repository, licensed under Apache 2.0. If you would like to give this a try, you can...

Malicious Package

Overview appit-cordova-plugin-ionic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview cordova-plugin-geofence-appit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...