Malicious Package

Overview @wizloft/harness-plugin-repository-files is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

CLSA-2026-1787145903 cups: Fix of CVE-2021-25317

CVE-2021-25317: ship /var/log/cups owned by root:lp instead of lp:sys so a local lp user can no longer plant a symlink in the log directory and make the root cupsd create arbitrary root-owned files, matching current RHEL 9 packaging...

CVE-2026-18372

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

PYSEC-2026-3701 surfio has an out-of-bounds read

Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service. Patches The bug has been patched in version 0.0.19...

CVE-2026-18372

M-Files Web before version 26.8.16330.2 is affected by a CSS injection vulnerability. An authenticated vault administrator can inject arbitrary CSS into the web user interface displayed to other vault users, resulting in low integrity impact on both the vulnerable and subsequent systems. The CVSS...

CVE-2026-18372 CSS injection in M-Files Web

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

EUVD-2026-62370

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18371 HTML injection in M-Files Web

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

Malicious code in @wizloft/harness-plugin-repository-files (npm)

Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a 35KB obfuscator.io-packed IIFE 303-entry rotated string...

CLSA-2026-1787131590 inkscape: Fix of CVE-2026-4980

CVE-2026-4980: Limit XInclude processing to shortcut keys files - Drop BuildRequires on aspell-en: the package is not present in AlmaLinux 9.6 BaseOS, AppStream, CRB, devel nor in the TuxCare 9.6 repositories; it is an EPEL-only package. It is a runtime dictionary that the build does not consume,...

MAL-2026-14288 Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

Cisco Unified Multi Path Traversal

Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 --...

Zyxel ZyWALL USG Extract Hashes

Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. !/usr/bin/env python3 ...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

D-Link DVG-N5402SP Path Traversal

Module exploits D-Link DVG-N5402SP path traversal vulnerability, which allows reading files form the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DVG-N5402SP Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...