596 matches found
Malicious code in vectordb-engine (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42695503b90ec4adc30c038c3321d637f05038f841bcc5f463a16b891fe4e3e0 During pip install, a custom buildext step in src/vectordbenginebuild.py runs an obfuscated payload that performs targeted reconnaissance and...
MAL-2026-4678 Malicious code in sysnode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1f5d271eb72dffa8868b2701aeb4aa7799ee9d7294f342e14682b6675114077 Package self-describes as a 'System binary configuration tool' but on invocation CLI/bin entry or require it silently bootstraps a full surveillance...
CVE-2026-8419
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...
CVE-2026-8419 Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...
CVE-2026-8419
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...
CVE-2026-8419 Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...
CVE-2026-8419
The CVE-2026-8419 entry aggregates a CSRF vulnerability in the WordPress Amazon Scraper plugin (versions up to and including 1.1). The underlying issue is missing or incorrect nonce validation in a function, enabling unauthenticated attackers to update settings and inject stored scripts by tricki...
CVE-2026-8419: Cross-Site Request Forgery (CSRF)
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scrip...
PT-2026-42077
Name of the Vulnerable Software and Affected Versions Amazon Scraper versions prior to 1.2 Description The Amazon Scraper plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw. This occurs because of missing or incorrect nonce validation—a security token used to ensure requests are...
WordPress plugin Amazon Scraper: Cross-site Request Forgery vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress Amazon Scraper plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Amazon Scraper versions = 1.1...
cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2026-42304 via twisted (19.2.1)
twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...
carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2026-42304 via twisted (22.4.0)
twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2026-42304 Source advisory:...
Identifying AI Web Scrapers Using Canary Tokens
From pre-training to query-time augmentation, web-scraped data helps to improve the quality and contextual relevancy of content generated by large language models LLMs. However, large-scale web scraping to feed LLMs can affect site stability and raise legal, privacy, or ethics concerns. If websit...
CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...
cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2026-42304 via twisted (19.2.1)
twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...
dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2026-42308 via pillow (3.4.2)
pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2026-42308 Sour...
9gag-scraper (>=0.0.6, <=0.0.7), agora-community-sdk (>=0.1.7, <=0.1.10) +142 more potentially affected by CVE-2026-42308 via pillow (6.2.2)
pillow PYPI version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 9gag-scraper =0.0.6, =0.1.7, =0.0.1.dev1, =0.1.0, =0.1.0, =1.0.0, =0.26.0.dev2, =0.0.1, =20.1.1, =2.0.0, =3.0.2, =0.16.0, =0.18.2 - colornet 0.2.0 a...
CVE-2026-7146
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...