Malicious code in @beloved-lenora/opencode-shell-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 122dea54602061507a3752f709f1e910d9126fdaf9fb282aeab13caca388b3e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-shared-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 884dad30e4b92d47985e1d8e7db8580665e8a5cd392023ea672243b62685b157 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84f3316cd114c1dae8ec5b0470fc9f16297c74c495b645085103a553002e825e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-btw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d95b5328fe2ba73358ca014724b677f69e5b9f8dda1429c105fde5c823dc2fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-goal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39f1eed75bb488db0e57e37f9f513e30a616eb00464b41c33bdea3342b9969b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-orchestrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb9b82fbe28422745ef37e0239d9a11d86705c6a93808e1e90303e31622db2fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Certighost-CVE-2026-54121

Document Type: Detection Use Case Related CVE: CVE-2026-54121 Certighost Author: Youssef Benchater Detection Use Case: Certighost CVE-2026-54121 This document describes the Splunk detection built for CVE-2026-54121. It follows the standard detection use case format so it can sit in a detection...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...

certificate-of-compromise

Certificate of Compromise SoK/Whitepaper on Offensive Operations against Active Directory Certificate Service v1.0.0 Living Document & Community Contributions This paper is a living document. ADCS research is not static — techniques get patched, new conditions are discovered, and community analys...

public-research

Nokia Deepfield ERT — public research Threat research from the Nokia Deepfield Emergency Response Team ERT, focused on DDoS botnets and related infrastructure. Each directory covers a botnet family with a brief summary and machine-readable indicators of compromise IoCs. This repo consolidates pri...

iocs

Zscaler ThreatLabz IOCs This repository contains Indicators of Compromise IOCs from the Zscaler ThreatLabz team. Follow us on Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...

ioc

IoC Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs. Licenses The content of this repository is released under the Detection Rule License DRL 1.1...

mikrotik0dayScanner

Mikrotik 0day Credential Disclosure Scanner Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The weakness exists due to improper authentication in the exposed by default Winbox interface on port 8291/TCP. A remote attacker can send specially...

EUVD-2026-102644

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

CVE-2026-109515 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

cve-2023-20198

cve-2023-20198 Description. 1vere$k POC on the CVE-2023-20198 based on the Blog. Also including a check on hexademical response according to the original Cisco article. The script works in the two modes: check mode which is just makes a connection for the particular URL and checks a response code...

GOSINT

GOSINT - Open Source Threat Intelligence Gathering and Processing Framework The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise IOCs. GOSINT allows a security analyst to collect and standardize structured and unstructured threat...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...