Lucene search
+L

4155 matches found

Kitploit
Kitploit
added 2026/09/04 2:56 a.m.7 views

aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/04 12:04 a.m.4 views

ore-mal-pkg-inspector

OreWatch बहु-पारिस्थितिकी तंत्र दुर्भावनापूर्ण पैकेज का पता लगाना और आपूर्ति श्रृंखला सुरक्षा स्कैनर एक उत्पादन-ग्रेड सुरक्षा उपकरण जो npm, PyPI, Maven, RubyGems, Go और Cargo पारिस्थितिकी तंत्रों में दुर्भावनापूर्ण पैकेजों और आपूर्ति श्रृंखला खतरों का पता लगाता है। यह आपके प्रोजेक्ट्स में समझौता ...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/03 10:11 p.m.4 views

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

5.9AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/03 7:45 p.m.4 views

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

5.8AI score
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/03 7:19 p.m.4 views

packj

Packj दुर्भावनापूर्ण/जोखिमपूर्ण ओपन-सोर्स पैकेजों को चिह्नित करता है Packj उच्चारित 'पैकेज' एक उपकरण है जो सॉफ़्टवेयर आपूर्ति श्रृंखला हमलों को कम करने में मदद करता है। यह लोकप्रिय ओपन-सोर्स पैकेज रजिस्ट्रियों जैसे NPM, RubyGems और PyPI से दुर्भावनापूर्ण, कमजोर, परित्यक्त, टाइपो-स्क्वाटिंग और अन्...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/03 7:01 p.m.3 views

msidump

msidump MSI Dump - एक उपकरण जो दुर्भावनापूर्ण MSI इंस्टॉलेशन पैकेजों का विश्लेषण करता है, फ़ाइलें, स्ट्रीम, बाइनरी डेटा निकालता है और इसमें YARA स्कैनर शामिल है। मैक्रो-सक्षम Office दस्तावेज़ों पर हम तुरंत oletools mraptor का उपयोग करके यह निर्धारित कर सकते हैं कि दस्तावेज़ दुर्भावनापूर्ण है या...

5.9AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/08/30 3:17 p.m.6 views

cisco_asa_research

أبحاث Cisco ASA يحتوي هذا المستودع على الشرائح والكود المعروض في Black Hat USA 2022 و DEF CON 30. يمكن العثور على ما يلي: شرائح حزم شرائح DEF CON 30 و Black Hat. حزمة DEF CON أطول قليلاً نظرًا لطول الفترة الزمنية المخصصة. theway - أداة لإنشاء حزم ASDM خبيثة/قابلة للتوزيع لـ Cisco ASA...

9.3CVSS7AI score0.4831EPSS
SaveExploits7References7
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

7.1CVSS8.1AI score0.00233EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.9 views

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

8.2CVSS6.4AI score0.00339EPSS
SaveExploits0References2
The Hacker News
The Hacker News
added 2026/08/07 6:48 p.m.38 views

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

6.8AI score
SaveExploits0
EUVD
EUVD
added 2026/08/01 12:22 p.m.12 views

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

6.1CVSS5.6AI score0.00172EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:22 p.m.12 views

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

6.1CVSS5.6AI score0.00172EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/01 12:22 p.m.80 views

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

6.1CVSS5.6AI score0.00172EPSS
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/31 2:54 p.m.26 views

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

5.9AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/31 2:21 p.m.19 views

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

6AI score
SaveExploits0References3
The Hacker News
The Hacker News
added 2026/07/17 6:54 p.m.29 views

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

6.2AI score
SaveExploits0
CVE
CVE
added 2026/07/15 6:52 p.m.72 views

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

9.3CVSS6.1AI score0.00524EPSS
SaveExploits0References4
The Hacker News
The Hacker News
added 2026/07/04 11:17 a.m.35 views

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

6.4AI score
SaveExploits0
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

9.8CVSS6.4AI score0.00635EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/06/21 1:27 p.m.10 views

CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package...

9.4CVSS6.8AI score0.007EPSS
SaveExploits0References4
Rows per page
Query Builder