295338 matches found
PT-2026-131695
TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
Malicious code in signalledger-bridge (npm)
signalledger-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...
PT-2026-133054
TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.29.0-tuxcare.1...
CVE-2026-103311: Insufficient Verification of Data Authenticity
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...
PT-2026-133089
TuxCare rebuilt @babel/plugin-transform-regenerator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
PT-2026-132517
TuxCare rebuilt @babel/plugin-transform-typescript to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
PT-2026-133091
TuxCare rebuilt @babel/plugin-transform-regenerator to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
PT-2026-133055
TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
Malicious code in signalledger-diagnostics (npm)
signalledger-diagnostics 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...
Malicious code in animatecss-tailwind-plugin (npm)
animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...
MAL-2026-18072 Malicious code in animatecss-tailwind-plugin (npm)
animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...
MAL-2026-18075 Malicious code in signalledger-bridge (npm)
signalledger-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...
PT-2026-117269
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
PT-2026-117256
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...
PT-2026-117257
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...
PT-2026-117236
The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...
PT-2026-117247
Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description Insufficient sanitization and escaping of several gallery shortcode attributes occur before they are embedded in a single-quoted HTML attribute within the rendered gallery...
PT-2026-117466
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...