CVE-2026-123025

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a...

Pummel

██████╗ ██╗ ██╗███╗ ███╗███╗ ███╗███████╗██╗ ██╔══██╗██║ ██║████╗ ████║████╗ ████║██╔════╝██║ ██████╔╝██║ ██║██╔████╔██║██╔████╔██║█████╗ ██║ ██╔═══╝ ██║ ██║██║╚██╔╝██║██║╚██╔╝██║██╔══╝ ██║ ██║ ╚██████╔╝██║ ╚═╝ ██║██║ ╚═╝ ██║███████╗███████╗ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝ Disclaimer:...

Malicious code in solidity-map (npm)

solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below match that...

Malicious code in testtestkjkldfnjdfn (npm)

testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function... call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api MAL-2026-17220 campaign; the file hashes below match that record's...

Malicious code in solidity-cat (npm)

solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold MAL-2026-14246 campaign; the file hashes below match that record's evidence. The...

Malicious code in solidity-gas-watcher (npm)

solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below matc...

Malicious code in loader-utils-kit (npm)

loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents itself as an...

Malicious code in cs-core-api-phoenix (npm)

cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent. --- Credit...

Malicious code in pino-std (npm)

pino-std ships lib/contract.js, byte-identical to the pino-testkit payload: a copy of the pino logger with an extra obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The...

Malicious code in @k.vict1999/pino-std-serializers (npm)

@k.vict1999/pino-std-serializers ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents...

CVE-2026-123025

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a...

CVE-2026-123025

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a...

CVE-2026-90967

The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial...

CVE-2026-90966

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment...

CVE-2026-91049

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run...

CVE-2026-86442

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to conver...

CVE-2026-16304

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to...

CVE-2026-85347

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the...

CVE-2026-85346

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions such as Subscriber to disclose the configuration and stored file listin...

CVE-2026-85351

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery SSRF...