41885 matches found
CVE-2026-6424
creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc4snwj324 2026-07-16 14:22:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqrgqi6bdf2g...
Malicious code in @hibachi-xyz/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...
Malicious code in @hibachi-xyz/ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...
Malicious code in @hibachi-xyz/sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...
CVE-2026-15407
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
Open Redirect
Snipe-IT is vulnerable to Open Redirect. The vulnerability is due to improper trust of the attacker-controlled Referer header, where the previous URL is stored in the session and later used for redirection without validation, allowing attackers to redirect users to malicious websites after a...
CVE-2026-12978
creationtimestamp| type| source ---|---|--- 2026-07-16 07:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqr3rj5be2u...
CVE-2026-15407 Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-15407
The CVE-2026-15407 entry describes an authorization bypass in Themify Builder for WordPress up to version 7.7.7. The underlying issue is insufficient verification of a user’s authorization for actions performed via the tb_generate_on_fly AJAX action, enabling authenticated users with subscriber-l...
CVE-2026-12395
creationtimestamp| type| source ---|---|--- 2026-07-16 07:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqsfnohs22...
CVE-2026-12906
creationtimestamp| type| source ---|---|--- 2026-07-16 07:45:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqkgc65d22...
CVE-2026-15306
creationtimestamp| type| source ---|---|--- 2026-07-16 07:41:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqdhqwci2a...
CVE-2026-12906
The CVE-2026-12906 entry concerns RTMKit Addons for Elementor for WordPress. It affects the plugin prior to version 2.0.9, where an AJAX action does not perform a necessary capability check and returns a post identifier supplied in the request. This allows users with at least the Contributor role...
EUVD-2026-44879
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed pos...
CVE-2026-12906 RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed pos...
CVE-2026-12409
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...
CVE-2026-12941
creationtimestamp| type| source ---|---|--- 2026-07-16 04:09:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqehp3ecv2m...
CVE-2026-12434
creationtimestamp| type| source ---|---|--- 2026-07-16 04:00:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqdx2slhz2m...