---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (5dbaab600b019adf2c2553d98e0e305123f6210e6a5986fc858eff66b29a9885)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-128132 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 have an uncontrolled resource consumption issue where the WebSocket reader continues parsing frames after the receive queue pauses the transport, and empty messages are not counted toward the queue size. This can lead to excessive memory use when a remote peer sends many small or compressed messages rapidly. The issue is fixed in version 3.14.4.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (bfe212e068980697c618a58b318fcab2eb9c47bfc532b0ca7ef60c4326de8b85)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (773c5a463f2a4a6e1ae5830b3504518f6687aa961f44bcc95ce680c4b3629d8d)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (39777ddf731062287854db0162ff10827ed4479a5257d86577df40636b4b97a1)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (1a9ff6f9be711504b49483462591eeb9aa0ffb56741babba62436820b69460c1)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (e987fbec6ebb6c7ba2f151656473898f62021df1c0a5c539f3a19f6c4c6dca50)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (33b9d1ebbc3cfe26ec43cce89b579cf28937af21f28224ad8ab950c877f80623)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (14e992d0cb2d0f3dc0efffb831d807312151587af9673cb216678c1c17d2df39)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Injection Guard plugin for WordPress versions before 1.4.0 contains a cross-site request forgery (CSRF) vulnerability. This flaw allows unauthenticated attackers to trick a logged-in administrator into triggering a password hash export by loading a crafted link. The vulnerability arises because the ig_settings admin page processes GET parameters without nonce verification. Exploitation results in writing WooCommerce customer email and password hashes to an unprotected file, which can be downloaded without authentication for offline cracking.
CVE-2026-128131 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 decompress concatenated compressed streams inefficiently, causing quadratic CPU usage. This can allow a remote attacker to block the server event loop by sending crafted compressed request bodies or WebSocket messages. The issue is fixed in version 3.14.4.
A vulnerability in @sveltejs/adapter-cloudflare allows attackers who can influence prerendered redirect paths to inject arbitrary rules into the _redirects file generated during the build adapt phase. This affects versions >=4.7.0 <7.2.10 and >=8.0.0-next.0 <8.0.2. The flaw can lead to unauthorized control over redirect entries on the Cloudflare platform. Fixed versions 7.2.10 and 8.0.2 address this issue.
A vulnerability in @sveltejs/adapter-node causes the server to crash when proxying certain requests via fetch due to attempts to add headers to immutable requests. This results in a denial of service for other requests handled by the server. The issue affects versions >=5.5.7 <5.5.8 and >=6.0.0-next.0 <6.0.1 and has been fixed in versions 5.5.8 and 6.0.1.
CVE-2026-128130 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 that run without the standard C-extension wheel or use AIOHTTP_NO_EXTENSIONS are affected. The issue arises when the pipelined request queue is full, causing the pure-Python parser to store unparsed data and return it to the caller. This leads to repeated processing of already-handled requests and excessive memory consumption. The vulnerability is fixed in version 3.14.4.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.
CVE-2026-128128 is a vulnerability in aiohttp versions prior to 3.14.4 where the C WebSocket reader uses signed 64-bit arithmetic to add a declared frame length to an already buffered partial message size. This can cause an integer overflow near 2^63, bypassing the max_msg_size check and allowing a remote attacker to cause unbounded memory consumption by sending a small non-final fragment followed by an oversized message. The Python WebSocket reader is not affected. The issue is fixed in version 3.14.4.
Tornado versions prior to 6.6.1 contain an open redirect vulnerability due to inconsistent URL parsing between browsers and Python's urllib. This discrepancy allows URLs starting with three or more slashes to bypass the redirect protections fixed in version 6.6.0. The issue is addressed in Tornado 6.6.1, which improves detection and fixes a regression from the previous fix.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (210090ccc9100e6c597aad39d11e410acef8a071607f39e03f2390a241d72993)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (96eae7b1c28054524f2c4203894a47a04560e1a0ed000f06c24fe462cd23b5fa)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2ccd8066def4bcb091eb9569a4da819bf85fcdb79b84f13c1929631fdf3f8023)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.