Post to Google My Business plugin for WordPress versions before 3.5.7 contains a blind server-side request forgery (SSRF) vulnerability. Authenticated users with Contributor-level privileges or higher can exploit this flaw by supplying a crafted URL that triggers the server to send requests to arbitrary hosts. This allows attackers to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and cause GET-based side effects on internal systems, bypassing network perimeter controls. The vulnerability is fixed in version 3.5.7.
CVE-2026-120151 is a vulnerability involving type confusion in PostgreSQL's plpgsql record-field feature that can lead to arbitrary code execution. The affected product is Microsoft software versions 3.0 and 4.0. No CVSS score or detailed impact information is provided. No known exploits in the wild have been reported. No patch or remediation details are available.
The npm package 'dowload_ebok_on_the_fourfold_root_of_the_principle_of_suffici_a_by_arthur_schopenhauer_y9sxo' is identified as malicious software. Installation or execution of this package results in full compromise of the affected computer. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine due to the high risk of persistent malicious control.
The npm package 'dowload_ebok_het_verhaal_van_het_verloren_kind_by_elena_ferrante_vj9ct' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee full remediation due to potential persistent malicious software.
The npm package 'dowload_ebok_the_white_rabbit_chronicles_by_gena_showalter_zri68' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'dowload_ebok_smoothies_recettes_de_smoothies_pour_perdre_du_po_by_richard_steyn_jsnng' contains malicious code. Any computer with this package installed or running should be considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, secure computer. Due to potential full control by an attacker, removal of the package may not eliminate all malicious software.
The npm package 'dowload_ebok_secret_r_t02_by_haruki_hlulb' contains malicious code that compromises any computer on which it is installed or running. Installation of this package results in a full system compromise, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised. However, due to the extent of the compromise, removal alone may not eliminate all malicious software introduced by this package.
The npm package 'dowload_ebok_hyperventilatie_ontkracht_by_chris_lenaerts_1ec8j' contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The NLTK library's SteppingRecursiveDescentParser.parse() method performs an unbounded top-down search on ambiguous or self-embedding grammars without enforcing any time or step limits. This allows an attacker who can influence the grammar and input tokens to cause the parser to consume CPU indefinitely, resulting in a denial of service. The base RecursiveDescentParser enforces a max_time limit, but the stepping subclass overrides this behavior and lacks any timeout mechanism. This vulnerability affects NLTK versions prior to 3.10.4.
CVE-2026-120150 is a use-after-free vulnerability in PostgreSQL's expanded-record domain-check functionality that could allow arbitrary code execution. The vulnerability affects Microsoft products with versions 3.0 and 4.0. No CVSS score or patch information is currently available.
The npm package 'dowload_ebok_servir_froid_by_joe_abercrombie_idu4e' is identified as malicious. Any system with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a separate, uncompromised system. However, removal of the package may not eliminate all malicious software introduced by it.
The npm package 'dowload_ebok_liber_s_by_falco_tarassaco_0wkz6' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but complete remediation may require rotating all secrets and keys from a separate, uncompromised system.
The npm package 'dowload_ebok_la_dieta_fodmap_by_cinzia_cuneo_nsekd' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but complete remediation may require rotating all secrets and keys from a separate, uncompromised system due to potential persistent control by attackers.
The npm package 'dowload_ebok_illuminae_by_amie_kaufman_fj2is' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_de_berserkers_by_karel_biddeloo_pht8r' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removal of the package alone may not eliminate all malicious software, as the attacker may have established persistent control.
The npm package 'dowload_ebok_bound_todliche_erinnerung_by_cynthia_eden_xnw3s' contains malicious code that compromises any computer on which it is installed or run. Installation of this package results in full system compromise, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Removal of the package alone may not eliminate all malicious software introduced by it.
The npm package 'dowload_ebok_atten_grader_minus_by_stefan_ahnhem_18r90' contains malicious code that compromises any computer on which it is installed or executed. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
CVE-2026-120149 is a vulnerability in Microsoft products involving PostgreSQL FDW batch-insert mismatch that can lead to arbitrary code execution. The affected versions are 3.0 and 4.0. No CVSS score or detailed technical impact information is provided. There is no indication of known exploitation in the wild or available patches.
CVE-2026-120148 is a vulnerability involving PostgreSQL extended-statistics pseudo-type confusion that can lead to arbitrary code execution. It affects Microsoft products version 3.0 and 4.0. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches.
A use-after-free vulnerability exists in the PostgreSQL dblink extension related to reentrant disconnect operations. This flaw could allow execution of arbitrary code. The vulnerability affects specific versions 3.0 and 4.0 of the product. No CVSS score or detailed impact metrics are provided. No patch or remediation information is currently available.