1043 matches found
MAL-2026-10695 Malicious code in ai-p2p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...
Malicious Package
Overview websight2-p2p is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview websight-p2p is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-10698 Malicious code in websight2-p2p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...
Malicious code in websight-p2p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...
Malicious code in websight2-p2p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...
MAL-2026-10697 Malicious code in websight-p2p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...
Windows Command Shell, P2P Relay (via Python)
P2P relay agent KSRL v2 E2E + Ed25519 identity + ConPTY. Win10 1809+. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayconptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name":...
GHSA-4M69-67M6-PRQP Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache
Description Am I affected You are affected if: 1. You run any version of zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listenaddr is set, which is the default. 3. Your node processes blocks past the checkpoint height non-finalized state is active. All...
PT-2026-57596
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listen addr is set, which is the default. Summary The P2P codec's Codec::decode method calls src.reservebody len + HEADER LEN after parsing a 24-byte protocol...
PT-2026-55393
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. Summary A malicious peer can answer Zebra's outbound getblocks/FindBlocks request with a small two-hash inventory, then ser...
PT-2026-55472
Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description A remote unauthenticated P2P peer can stall a Zcash node by racing an invalid block body against a valid canonical body for the same block header hash. This is possible because ZIP-244 allows an attack...
GO-2026-5628 Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go
Klever-Go KVM: Unauthenticated remote node crash nil-pointer DoS in klever-go P2P transaction interceptor txVersionChecker nil RawData - potential chain halt in github.com/klever-io/klever-go...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Release the per-CPU pgmap reference when vminsertpage fails. When vminsertpage fails in p2pmemallocmmap, p2pmemallocmmap does not invoke percpurefput to free the per-CPU reference to pgmap acquired after...
Unix Command Shell, P2P Relay (via Python)
P2P relay agent KSRL v2 E2E + Ed25519 identity + PTY. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix Command Shell, P2...
Unix Command Shell, P2P Relay (via Bash)
Connect to a P2P relay hub as AGENT cleartext KSRL v1. For E2E encryption + PTY use payloads/singles/cmd/unix/pythonp2prelay. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Unix Command Shell, P2P Relay via Bash", "description": "Connect to ...
CVE-2026-34067
nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, HistoryTreeProof::verify panics on a malformed proof where history.len != positions.len due to asserteq!history.len, positions.len. The proof object is derived from untrusted p2...
Klever-Go KVM: Hash-array amplification in P2P resolver request handling
Summary A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expands into 200000 decoded hash entries inside the resolver path. On klever-go v1.7.17, this allows remote memory and CPU amplification against nodes that accept P2P...
SUSE CVE-2026-46268
In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Fix p2pmemallocmmap warning condition Commit b7e282378773 has already changed the initial page refcount of p2pdma page from one to zero, however, in p2pmemallocmmap it uses "VMWARNONONCEPAGE!pagerefcountpage" to asser...
CVE-2026-44697
CVE-2026-44697 describes a remote denial-of-service in Klever-Go where a peer can cause a receiving node to allocate multi-gigabytes of heap from a sub-50 KiB compressed gossip payload. The root cause is an unbounded gzip decompression in Batch.Decompress (Batch.Stream) via Batch.Decompress/Batch...