Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

ResetSpy

ResetSpy Sondea el endpoint de restablecimiento de contraseña de autoservicio SSPR de Microsoft para enumerar los métodos de verificación registrados y señalar cualquiera que carezca de un segundo factor fuerte. Proporciona enumeración de usuarios y una aproximación de la postura de MFA en cuenta...

CVE-2026-97498

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Memory queue and firmware buffer objects used by user queues were not pinned in memory, allowing them to be evicted during memory pressure. A local user could exploit this issue to cause the graphics hardware to access invalid memory...

CVE-2026-97989

A flaw was found in the Linux kernel's vDPA Device in Userspace VDUSE subsystem. The driver does not properly validate virtqueue alignment parameters during device configuration, allowing invalid or zero alignment values to pass into internal queue creation routines. A local user could exploit th...

CVE-2026-97497

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. The queue allocation mechanism failed to validate user-supplied SDMA System Direct Memory Access queue identifiers during queue restoration. A local user could exploit this vulnerability to trigger an out-of-bounds memory access,...

CVE-2024-29972

TG Join Us https://t.me/WanLiChangChengWanLiChang Join us to regularly receive various vulnerability EXP POCs CVE-2024-29972-EXP CVE-2024-29972 Zyxel NAS Backdoor Account: Unauthorized activation of backdoor account FOFA app="ZyXEL-NAS326" Notes This EXP exploitation script is a combination of...

CVE-2026-97495

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user could exploit this vulnerability to cause a Denial of Service DoS or kernel memory corruption by supplying an out-of-bounds doorbell identifier during queue allocation. The issue occurs because the doorbell allocation...

CVE-2026-97496

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local attacker can trigger this vulnerability during process restoration by supplying manipulated queue descriptor values that lack proper boundary validation. This issue results in an out-of-bounds memory read, potentially exposing...

CVE-2023-5561-PoC

PoC CVE-2023-5561 - Divulgación de correos electrónicos de usuarios de WordPress Descripción Este script explota la vulnerabilidad CVE-2023-5561 en WordPress para enumerar y divulgar las direcciones de correo electrónico de los usuarios a través del endpoint de la API /wp-json/wp/v2/users...

CVE-2025-1974

CVE-2025-1974 — IngressNightmare ingress-nginx Introducción Este documento presenta la investigación de la vulnerabilidad CVE-2025-1974 , que afecta al componente ingress-nginx validating admission controller para Kubernetes. CVE-2025-1974 es una vulnerabilidad crítica CVSS 3.1 9.8, que consiste ...

CVE-2024-8465-PoC

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

cpra

Continuous Pulse and Recovery Agent Checks services, sends alerts, and runs the recovery actions you configure. CPRa is a self-hosted monitoring and recovery agent written in Go. It runs health checks against your services on a schedule, opens and closes incidents against configurable thresholds,...

Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe. The activity, observed by Mandiant Consulting and Google Threat Intelligence Group GTIG in September 2026...

CVE-2026-97985

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering an infinite busy-wait loop on the system. When processing local Unix domain sockets AFUNIX containing out-of-band OOB data, the kernel fails to update internal queue markers during certain receive...

CVE-2026-102508

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...

CVE-2023-22515

CVE-2023-22515: Informe de análisis de vulnerabilidad de escalada de privilegios en Confluence Data Center & Server 1. Resumen Overview CVE-2023-22515 es una vulnerabilidad crítica de Control de Acceso Roto Broken Access Control encontrada en los productos Atlassian Confluence Data Center y...

Exploit for CVE-2026-102425

CVE-2026-102425 — Balbooa Forms combaforms field shortcode...

PoC-RCE-CVE-2025-55182

🔥 RSC RCE Exploit Toolkit Kit de explotación avanzado para vulnerabilidades de ejecución remota de código en React Server Components Solo para pruebas de penetración autorizadas e investigación de seguridad Características • Instalación • Uso • Integración con Shodan • Ejemplos • Aviso legal 📋...

CVE-2026-102508 Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...

EUVD-2026-89674

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...