295381 matches found
Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain
As large language models LLMs are increasingly integrated into Web search, online recommendation, and intelligent decision-making, the third-party plugin ecosystem centered on model customization continues to grow. Among these, Steering Vectors guide model behavior by intervening in internal...
PT-2026-123340
Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...
PT-2026-123153
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps ajax delete saved search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launch...
PT-2026-123216
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin init of the file /tmp/upload files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd options leads to unrestricted upload. The attack may be launched...
CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792804368)
The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792804368 advisory. - A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the...
CLSA-2026-1792938613 TuxCare security update for gatsby-plugin-sharp (1 CVE)
TuxCare rebuilt gatsby-plugin-sharp to address 1 CVE. Fixed in 2.14.4-tuxcare.1...
emqx-RCE
EMQX Dashboard - RCE This is a malicious plugin for EMQX Dashboard which allows to execute commands remotely. The code in this repository is mostly based on one of the latest releases of the EMQX plugin template repository, licensed under Apache 2.0. If you would like to give this a try, you can...
Malicious Package
Overview cordova-plugin-geofence-appit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview appit-cordova-plugin-ionic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malware in appit-cordova-plugin-ionic
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in cordova-plugin-geofence-appit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18256 Malicious code in cordova-plugin-geofence-appit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18254 Malicious code in appit-cordova-plugin-ionic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in cordova-plugin-geofence-appit
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in appit-cordova-plugin-ionic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-94295
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any...
CVE-2026-115214
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator...
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
CVE-2026-111978
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP...
EUVD-2026-109352
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator...