Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

MAL-2026-17479 Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

MAL-2026-17491 Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

CVE-2026-58231

Скрипт обнаружения CVE-2026-58231 Инструмент обнаружения и проверки предусловий для CVE-2026-58231 — некорректная авторизация в компоненте Data Hub Adapter продукта SAP Commerce Cloud CVSS 10.0. Скрипт выполняет только неразрушающие проверки. Он не содержит и не выполняет полезной нагрузки для...

CVE-2024-38063

CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution 1. Project Overview This repository contains our research and analysis of CVE-2024-38063 , a critical vulnerability in the Windows TCP/IP stack. CVE stands for Common Vulnerabilities and Exposures. It is a standardized dictionary...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF Образовательная / защитная цель : эта лаборатория содержит намеренно уязвимое приложение Log4j 2.14.1 и набор JNDI эксплойтов, ТОЛЬКО для изучения обнаружения и блокировки Log4Shell в изолированной среде. Не разворачивайте в Интернете и не используйте д...

CVE-2026-81648

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81648 CVE-2026-81648 CryptoPayment Gateway 1.2.2 - Granwill I am @abraxasnull. Loopback lab. The client is CVE-2026-81648-Abraxas-Labs.py. The guard is never called. Direct POST vendor/cryptd/ajax.php, not...

puppet-ssh-hardening

Puppet SSH 강화 설명 이 Puppet 모듈은 안전한 ssh-client 및 ssh-server 구성을 제공합니다. 요구 사항 Puppet Puppet 모듈: saz/ssh = 2.3.6, puppetlabs/stdlib = 4.2.0 매개변수 ipv6enabled = false - IPv6가 필요한 경우 true cbcrequired = false - 암호화에 CBC가 필요한 경우 true. 이는 일반적으로 구성된 보안 암호화가 활성화되지 않은 구형 M2M 메커니즘이 SSH와 통신해야 하는 경우에만 필요합니다...

chef-ssh-hardening

ssh-hardening Chef cookbook 1 2 3 4 설명 이 쿡북은 보안이 강화된 ssh-client 및 ssh-server 구성을 제공합니다. 이 쿡북은 사용자 및/또는 ssh 키 관리 기능을 제공하지 않으므로, 해당 기능은 다른 쿡북을 사용하시기 바랍니다. 요구 사항 Chef = 14.13.11 플랫폼 Debian 8, 9, 10 Ubuntu 16.04, 18.04 RHEL 6, 7 CentOS 6, 7 Oracle Linux 6, 7 Fedora 29, 30 OpenSuse Leap 42 Amazon Linu...

ai_bobao

aibobao AI-Powered Vulnerability Intelligence Feed Simp...

fusee-gelee

fusee-gelee Реализация эксплойта Fusee Gelee CVE-2018-6242 для Nintendo Switch, основанная на уязвимости, раскрытой Kate Temkin / ReSwitched в марте 2018 года. Запускает произвольную полезную нагрузку например, hekate на устройстве с Tegra X1 в режиме USB Recovery RCM, полностью обходя проверку...

CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

cve-2020-14343-lab

CVE-2020-14343 – PyYAML Unsafe YAML Loading Lab 1. Project Overview This project demonstrates CVE-2020-14343 in a controlled and isolated Docker environment. The lab contains two environments: A vulnerable environment using PyYAML 5.3.1 A patched environment using PyYAML 5.4 and yaml.safeload The...

curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation

Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...

CVE-2021-40346

CVE-2021-40346: HTTP-контрабанда запросов HAProxy - обход ACL Обзор Этот проект демонстрирует CVE-2021-40346 , критическую уязвимость целочисленного переполнения в HAProxy, которая позволяет проводить атаки HTTP-контрабанды запросов для обхода средств защиты. Оценка CVSSv3: 7.5 Высокая Авторы: 1...