r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

CVE-2022-29072

INFORMATION I haven't posted any poc code anywhere for privilege escalation attack. The poc codes found have nothing to do with privilege escalation. For your information. About 7-zip 7-Zip is a free and open-source file archiver. The command line version of 7-Zip is also available for Unix-like...

CVE-2025-55182-Exploit

React2Shell CVE-2025-55182 - Docker Vulnerable Lab An intentional vulnerable Next.js application demonstrating Remote Code Execution RCE via insecure Child Process handling. This lab is designed for educational purposes and security testing. ⚠️ WARNING: DOT NOT RUN THIS ON A PUBLIC FACING SERVER...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

CVE-2019-11708

Full chain exploit for CVE-2019-11708 & CVE-2019-9810 This is a full browser compromise exploit chain CVE-2019-11708 & CVE-2019-9810 targeting Firefox on Windows 64-bit. It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 t...

Astra Linux – Vulnerability in Apache2

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child processes to crash. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability in Thunderbird

The parent process does not properly check whether the Speech Synthesis feature is enabled when receiving instructions from a child process. This vulnerability affects Thunderbird 91.9...

PT-2026-105468

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

PT-2026-93169

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash

A flaw was found in the modauthnsocache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration...

httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash

A flaw was found in the modauthnsocache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration...

MAL-2026-15913 Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

PT-2026-95384

Name of the Vulnerable Software and Affected Versions vm2 NodeVM versions prior to 3.12.1 Description A sandbox escape exists because the DANGEROUS BUILTINS denylist fails to include child process, even though other modules capable of spawning host processes are blocked. This allows attackers to...

Malicious Package

Overview bellatrix-child-process-playwright-geodynamo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview bellatrix-quantum-inquirer-child-process is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash

A flaw was found in the modauthnsocache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration...

PT-2026-83273

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

CVE-2026-76227

A flaw was found in Renovate. The application fails to restrict environment variables when it creates new child processes. This oversight allows these child processes, such as those used for package installation or post-upgrade tasks, to access all environment variables of the main Renovate...