124544 matches found
PEASS-ng v20260715-81d3c7f8
PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...
Malicious code in @debile/require-dir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script ru...
Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
MAL-2026-10634 Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
ROS-20260715-73-0024
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the use of memory after deallocation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-38753
A use-after-free vulnerability exists in the awk_sub() function (located in editors/awk.c ) of Busybox v1.38.0 . This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted AWK script . While some sources indicate the vulnerability may not have a vendor-supplied patch...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38752: Uncontrolled Recursion
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38753: Use After Free
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-61859: Improper Link Resolution Before File Access
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...
PT-2026-108652
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c44f-37qr-gw3f. This link is maintained to preserve external references. Original Description PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run skill script that executes...
CVE-2026-26719: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
ROS-20260715-73-0016
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...
ROS-20260715-73-0023
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to deficiencies in access control in isolated environments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-60312
Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A stack overflow occurs in the evaluate function editors/awk.c when processing a specially crafted AWK script, which can lead to a Denial of Service DoS. A stack overflow is a condition where...
ROS-20260715-73-0022
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to deficiencies in access control in isolated environments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...