telegram-osint-lib

Telegram OSINT scenario library Description A lot of Telegram API libraries around, but none of them demonstrates how to execute complex scenarios like draining all photos from channels, monitor users presence or register new account. This projects aims to correct situation: now you can easily...

CVE-2026-87045

A NULL pointer dereference exists in the Zephyr HTTP/2 server within subsys/net/lib/http/http_server_http2.c. The vulnerability occurs because handle_http_frame_header() unconditionally sets client->current_stream = NULL, but CONTINUATION frames do not re-bind the stream. This leads to a NULL ...

CVE-2026-87045 NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

dhcpoptinj

DHCP option injector Have you ever wanted to intercept DHCP requests and squeeze in a few extra DHCP options, unbeknownst to the sender? Probably not. However, should the need ever come, dhcpoptinj will hopefully help you. Why There can be many a reason to mangle DHCP requests, although chances a...

CVE-2026-123036

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

CVE-2026-87045: zephyrproject zephyr: The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of…

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

CVE-2026-85076

The Cronicle multi-server task scheduler and runner is vulnerable to privilege escalation via arbitrary environment variable injection through event parameters. Prior to version 0.9.124 , an authenticated non-admin user with run_events, create_events, or edit_events privileges can exploit lib/api...

CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with runevents, createevents, or editevents privilege can supply undeclared keys in event params through apicreateevent, apiupdateevent, or apirunevent. lib/api.js and...

CVE-2026-123036

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

EUVD-2026-117403

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

CVE-2026-123036

A flaw in ansible-core causes sensitive information to leak when a task marked with no_log: true fails. Although the task result is censored, the exception field remains in the PRESERVE allow-list (located in lib/ansible/_internal/_task.py), causing the default stdout callback to print it. This l...

CVE-2026-123036

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

Malicious code in xzvbailss (npm)

xzvbailss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in solidity-map (npm)

solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below match that...

Malicious code in solidity-gas-watcher (npm)

solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below matc...

Malicious code in @monze1239/baileys (npm)

@monze1239/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @dyllxnn/baileys (npm)

@dyllxnn/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @sakataa/baileys (npm)

@sakataa/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @axo_cuy/baileyss (npm)

@axocuy/baileyss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @denzz221/baileys (npm)

@denzz221/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...