PT-2026-94225

Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped Host.where call to build host queries, which fails to enforce the...

PT-2026-94365

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions prior to 6.2.2.0 Description The application fails to validate the URL scheme when verifying if a target URL is internal to the connected server. This allows a network-positioned attacker to load a plugin popout...

CVE-2026-75588: Improper Validation of Specified Type of Input

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

PT-2026-94168

Name of the Vulnerable Software and Affected Versions Dewa Kirim versions prior to 1.0.1 Description The Dewa Kirim WordPress plugin fails to escape delivery coordinates submitted during the checkout process before they are output within an inline script. This allows unauthenticated users to...

PT-2026-95191

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1 Description The Accounting plugin fails to sanitize the Payment Term note field, rendering it as raw HTML. Authenticated users with payment-term create permissions can submit arbitrary JavaScript to the...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

PT-2026-94174

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the plugin fails to enforce the signature on a payment callback. This allows unauthenticated users to disclose and delete stored payment parameters associated...

PT-2026-94170

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description Lack of authorization, sanitization, and escaping when adding or updating dictionary entries allows unauthenticated users to perform a Stored Cross-Site Scripting XSS attack. This...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

Malicious Package

Overview strapi-plugin-ccrec-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-cccon-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-ccip-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview strapi-plugin-listcc-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-ccrev-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-conresh-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-portcc-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview strapi-plugin-persh-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...