PT-2026-131697

TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

PT-2026-133092

TuxCare rebuilt @babel/plugin-transform-regenerator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-133039

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-133144

TuxCare rebuilt @babel/plugin-transform-react-jsx-source to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-133187

TuxCare rebuilt @babel/plugin-transform-destructuring to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-133045

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-133053

TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CVE-2026-94294: Missing Authorization

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

PT-2026-132033

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-133076

TuxCare rebuilt @babel/plugin-transform-classes to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-133091

TuxCare rebuilt @babel/plugin-transform-regenerator to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

CVE-2026-112328: Missing Authorization

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...

PT-2026-133056

TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

PT-2026-133054

TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-133089

TuxCare rebuilt @babel/plugin-transform-regenerator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-117237

Name of the Vulnerable Software and Affected Versions ElementsReady Addons for Elementor WordPress versions prior to 6.7.3 Description Insufficient authorization checks in several settings-save handlers allow users with subscriber-level access and above to overwrite stored settings. This includes...

Malicious code in signalledger-diagnostics (npm)

signalledger-diagnostics 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-plugin (npm)

animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

MAL-2026-18072 Malicious code in animatecss-tailwind-plugin (npm)

animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

MAL-2026-18075 Malicious code in signalledger-bridge (npm)

signalledger-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...