Lucene search
+L

231791 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago7 views

Malicious code in devplatform-spa-plugin-error-boundary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be The package's main index.js unconditionally requires./ext, which runs at load time and fetches a per-platform binary over HTTPS from...

5.9AI score
SaveExploits0References2
OSV
OSV
added 3 days ago6 views

MAL-2026-12777 Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

5.6AI score
SaveExploits0References2
OSV
OSV
added 3 days ago9 views

MAL-2026-12776 Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago6 views

Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

5.6AI score
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 3 days ago10 views

CVE-2026-15979

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

8.1CVSS6.5AI score0.00773EPSS
SaveExploits0References11
EUVD
EUVD
added 3 days ago6 views

EUVD-2026-53341

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

8.1CVSS6.5AI score0.00773EPSS
SaveExploits0References10
Cvelist
Cvelist
added 3 days ago28 views

CVE-2026-15979 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

8.1CVSS0.00773EPSS
SaveExploits0References10
CVE
CVE
added 3 days ago33 views

CVE-2026-7529

The CVE describes a vulnerability in the wiseCampaign – WooCommerce Conversions Made Easy WordPress plugin (versions '__return_true'. This allows unauthenticated attackers to read and modify plugin settings and assets (banner, stockbar, core settings, background uploads) without nonce or capabil...

7.5CVSS5.5AI score0.00351EPSS
SaveExploits0References10
EUVD
EUVD
added 3 days ago8 views

EUVD-2026-53340

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...

7.5CVSS5.5AI score0.00351EPSS
SaveExploits0References10
CVE
CVE
added 3 days ago27 views

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

7.2CVSS5.7AI score0.0023EPSS
SaveExploits0References7
Cvelist
Cvelist
added 3 days ago31 views

CVE-2026-7529 wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...

7.5CVSS0.00351EPSS
SaveExploits0References10
Cvelist
Cvelist
added 3 days ago30 views

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS0.0023EPSS
SaveExploits0References7
EUVD
EUVD
added 3 days ago6 views

EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS5.7AI score0.0023EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 3 days ago9 views

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS5.7AI score0.0023EPSS
SaveExploits0References8
EUVD
EUVD
added 3 days ago8 views

EUVD-2026-53338

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

6.5CVSS5.3AI score0.00246EPSS
SaveExploits0References7
Cvelist
Cvelist
added 3 days ago28 views

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

6.5CVSS0.00246EPSS
SaveExploits0References7
NVD
NVD
added 3 days ago7 views

CVE-2026-71294

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a ci POST parameter obtained via cotimport'ci', 'P', 'TXT' trim-only sanitization is passed to unserializebase64decode$...

7.6CVSS0.00224EPSS
SaveExploits0References2
Patchstack
Patchstack
added 3 days ago6 views

WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...

4.7CVSS5.4AI score0.00239EPSS
SaveExploits0References1Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago6 views

Malicious code in rollup-plugins-polyfills-rode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...

6.3AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago6 views

Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

6.2AI score
SaveExploits0References1
Rows per page
Query Builder