EUVD-2026-114575

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

CVE-2026-119977

WordPress Core versions 4.7.0 through 7.1.3 are vulnerable to an unauthenticated Remote Code Execution (RCE) flaw caused by predictable, web-accessible staging paths during full-package core upgrades. When a full update occurs, files are unpacked into a predictable directory under wp-content/upgr...

Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...