ObfuXtreme

If you find this GitHub repo useful, please consider giving it a star! ⭐ ⚡ ObfuXtreme — Advanced Python Obfuscation Engine ObfuXtreme is an advanced Python obfuscation engine focused on structural obfuscation , AST-level transformations , and runtime payload protection. It is designed for securit...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit To install the requirements execute: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Here is how to use the exploit: $ python primefaces.py -h...

Malicious code in iterquarry (PyPI)

Source: kam193 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

Malicious code in libseal (PyPI)

Source: kam193 7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09 In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

MAL-2026-18132 Malicious code in libseal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8ebbbca9850ab1485e13a15b5425b0c7c823adaaf480881ae7223ffdc254f Package libseal version 1.1.1 was scanned across 20 files with no a static rule matches and no traced behaviors indicating installer-side harm. No...

Malicious code in libseal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8ebbbca9850ab1485e13a15b5425b0c7c823adaaf480881ae7223ffdc254f Package libseal version 1.1.1 was scanned across 20 files with no a static rule matches and no traced behaviors indicating installer-side harm. No...

Malicious code in iterquarry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c408d2ad5c91bc36fcf3fb32c9649828b6c358f6eb0f32d71a18cfdc226c604d iterquarry 2.1.2 presents itself as an iterator utility library but is structured as a thin facade over a sibling PyPI package 'libseal'...

MAL-2026-18131 Malicious code in iterquarry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c408d2ad5c91bc36fcf3fb32c9649828b6c358f6eb0f32d71a18cfdc226c604d iterquarry 2.1.2 presents itself as an iterator utility library but is structured as a thin facade over a sibling PyPI package 'libseal'...

CVE-2026-106434

A flaw was found in MongoDB libmongocrypt. When processing an unrecognized encrypted payload during explicit decryption, the library returns the data unchanged instead of generating a decryption error. An attacker capable of modifying stored encrypted fields, such as a compromised database server...

CVE-2026-106434

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application...

Malicious code in pinochiomathm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e The package impersonates picomatch name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach. On...

Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-12176 Malicious code in dateuuidv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1 The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO at requi...

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...