Malicious code in sextant-relay-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43407b6c2131e12ca9f2b18ee48505dbf7541e67aca1b94ad4fdc41e9fbca7c0 The tarball contains a single darwin/arm64 Mach-O Go executable at bin/sextant-relay 6 MB, stripped and a minimal package.json with no scripts, main,...

Malicious code in sextant-cli-linux-arm64 (npm)

Source: amazon-inspector cb7ff319c462df37238c84a4d224ed57bb0020dba780f8b41b44705e479744b1 The tarball ships a linux/arm64 Go executable sxt as its sole payload. The binary embeds a PTY-spawning library github.com/creack/pty together with a WebSocket client github.com/coder/websocket and a full...

Exploit for CVE-2026-60004

CVE-2026-60004 - Gitea Once executed, the script will automa...

Malicious code in @ks-openclaw/kim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a563317f01b921a7425ae16f740c8fa729db03087afacfea903db3dd90e15803 The package's preinstall lifecycle script preinstall.js opens a TCP socket to the hardcoded remote host 120.55.170.103:8888, spawns cmd.exe, and pipe...

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

GHSA-5GPJ-VJ23-VHHV Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization via the /resolveauthenticatedconnection process. An attacker can gain unauthorized interactive terminal access by using a valid, unexpired JWT for an account with insufficient approval...

PT-2026-67909

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

Joern 4.0.595

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

DNP3 TCP Client

Connects to a DNP3 outstation and creates an interactive DNP3 shell session !/usr/bin/env python3 -- coding: utf-8 -- """DNP3 TCP bind listener — opens a DNP3 session for interactive polling.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 60870-5-104 Client

Connects to an IEC 104 server and creates an interactive IEC 104 shell session !/usr/bin/env python3 -- coding: utf-8 -- """IEC 60870-5-104 bind listener — opens an IEC 104 session for interrogation.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

PowerShell Command Shell, Reverse HTTPS (TLS)

Connect back over TLS SslStream and create an interactive command shell. No native reversehttps listener — terminate TLS on the operator side stunnel, openssl sserver, etc. and forward plaintext to listeners/multi/reversetcp, or use listeners/multi/reversetls for native TLS termination...

Python Reverse WebSocket Shell

Connect back over WebSocket and provide an interactive command shell stdlib only from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse WebSocket Shell", "description": "Connect back over WebSocket and provide an interactive command she...

SUSE CVE-2026-13379

The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...

SUSE CVE-2026-17534

Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...

Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

UBUNTU-CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

UBUNTU-CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

CVE-2026-13379

The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...