gladius

Gladius Modo fácil de Responder a Credenciales Autor: Cory Duplantis @ctfhacker / blog Artículo en el blog sobre Gladius asciicast Gladius proporciona un método automatizado para descifrar credenciales de diversas fuentes durante un compromiso. Actualmente desciframos hashes de Responder,...

pwndb

pwndb.py pwndb.py es una herramienta de línea de comandos en Python para buscar credenciales filtradas utilizando el servicio Onion del mismo nombre. Uso usage: pwndb.py -h --target TARGET --list LIST --output OUTPUT --proxy PROXY optional arguments: -h, --help show this help message and exit...

stacs

Escáner Estático de Tokens y Credenciales ¿Qué es? STACS es un escáner estático de credenciales impulsado por YARA que admite formatos de archivo binarios, análisis de archivos anidados, conjuntos de reglas y listas de ignorados componibles, e informes SARIF. ¿Qué soporta STACS? Actualmente, STAC...

PT-2026-108925

Name of the Vulnerable Software and Affected Versions openPDC affected versions not specified Description The published Docker image contains a fixed administrative credential that does not require a change upon first use. An attacker with network access to the management interface can use this...

CVE-2026-28745: Storing Passwords in a Recoverable Format

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system...

MAL-2026-17728 Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

MAL-2026-17720 Malicious code in @galicia-toolkit-cheques-nc/front (npm)

@galicia-toolkit-cheques-nc/front is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @galicia-toolkit-nestjs-20/commons (npm)

@galicia-toolkit-nestjs-20/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17730 Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

PT-2026-108985

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.11.0 through 3.3.14 Argo CD versions 3.4.0 through 3.4.9 Argo CD versions 3.5.0 through 3.5.3 Argo CD versions 3.6.0-rc1 and earlier Description The Argo CD repo-server is subject to command injection when cloning, testing, ...

Linux Distros Unpatched Vulnerability : CVE-2026-107714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin...

CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791483256)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791483256 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for...

Malicious code in @galicia-toolkit-cheques-nc/front (npm)

@galicia-toolkit-cheques-nc/front is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @brick-v2/tour (npm)

@brick-v2/tour is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @brick-v2/table (npm)

@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @brick-v2/brand (npm)

@brick-v2/brand is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

CVE-2026-55797: Improper Neutralization of Special Elements used in an OS Command

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...