Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...

CVE-2026-71294

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

CVE-2026-71278

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...

CVE-2026-16118

creationtimestamp| type| source ---|---|--- 2026-08-05 12:01:04+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msdi5cimtx2o 2026-08-12 12:01:25+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gfjsoq2p...

CVE-2026-71254

creationtimestamp| type| source ---|---|--- 2026-08-05 12:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msdi4bhzi62l 2026-08-05 12:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/117042788884411144 2026-08-05 12:40:04+00:00| seen|...

CVE-2026-71238

creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn2laot2o...

CVE-2026-71231

creationtimestamp| type| source ---|---|--- 2026-08-05 11:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgfwm5ur2f...

CVE-2026-71237

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...

EUVD-2026-53310

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...

CVE-2026-71213

creationtimestamp| type| source ---|---|--- 2026-08-05 09:24:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msd7el3ddz2z 2026-08-05 10:04:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/27z3zm2wyka4w...

CVE-2026-7105

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-4431

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...