TryHack3M-Bricks-Heist

TryHack3M: Bricks Heist Exploit • Writeup • CTF Challenge A comprehensive repository containing a custom exploit and detailed writeup for the TryHack3M: Bricks Heist challenge Quick Start • Repository Structure • The Exploit • The Writeup • Disclaimer Overview This repository documents the...

MAL-2026-18203 Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Command Injection

Overview aws-sam-cli is an AWS SAM CLI is a CLI tool for local development and testing of Serverless applications Affected versions of this package are vulnerable to Command Injection via the Makefile generator in makefilegenerator.py, which interpolates an attacker-controlled Terraform resource...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115350 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115350 Source advisory: SNYK:PYTHON-MISTUNE-21460666...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115351 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115351 Source advisory: SNYK:PYTHON-MISTUNE-21460665...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115353 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115353 Source advisory: SNYK:PYTHON-MISTUNE-21460661...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

JFP-Paradox Edge Radar ASA - Autonomous Agent Sniffer Lekki...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115355 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115355 Source advisory: MEND:CVE-2026-115355...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115352 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115352 Source advisory: MEND:CVE-2026-115352...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115348 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115348 Source advisory: MEND:CVE-2026-115348...

Out-of-bounds Read

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/framesubscriber.cc, where a captured video frame's...

Out-of-bounds Read

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/framesubscriber.cc, where a captur...

OESA-2026-4512 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. Thi...

OESA-2026-4511 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. Thi...

OESA-2026-4510 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. Thi...

CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

EUVD-2026-108113

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

CVE-2026-111079

A vulnerability exists in Goose where the terminal integration feature captures shell command history and transmits it verbatim to Large Language Model (LLM) provider endpoints without sanitization. If a user inputs sensitive data such as API tokens, passwords, or environment variables , this inf...

CVE-2026-111079 Goose: goose: shell history and environment leak via terminal integration

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...