MAL-2026-11122 Malicious code in @crbrc/xbt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

MAL-2026-11142 Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

MAL-2026-11141 Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...

Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

CVE-2026-64253

A flaw was found in the Linux kernel. The copyprocess function, responsible for creating new processes, incorrectly inherits a flag PFBLOCKTS from the parent process while simultaneously setting a related pointer current-plug to null in the child process. This inconsistency can lead to the kernel...

AWS CodeBuild Build Spec - Exposure Detection

Detected the presence of the AWS CodeBuild buildspec.yml file. This file contains build commands and settings that may disclose sensitive information about the application's build process and infrastructure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the AWS CodeBuild...

VTScada - Internet Client Panel Detection

VTScada by Trihedral Engineering is a SCADA platform used in water/ wastewater, oil and gas, and utilities. The Internet Client feature exposes a browser-based view of process data, and is commonly deployed by municipal water systems across North America. !/usr/bin/env python3 -- coding: utf-8 --...

Named Process Exporter Detection

Named process exporter is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Named process exporter is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Named Process Exporter Detection', 'description':...

Dahua IPC/VTH/VTO - Authentication Bypass Detection

Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. !/usr/bin/env python3 -- coding: utf-8 -- """Some Dahua products contain an authentication bypass during the login process."""...

CODESYS WebVisu - Panel Detection

CODESYS WebVisu is the web-based HMI Human-Machine Interface component of the CODESYS industrial automation runtime. It provides browser-based access to PLC visualizations and industrial control interfaces. Exposed instances may reveal real-time process data and control functions without...

Celonis Login - Panel Detection

Detects Celonis Process Intelligence login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Celonis Process Intelligence login panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Celonis Login - Panel...

Schneider Electric ClearSCADA - Panel Detection

ClearSCADA now branded as EcoStruxure Geo SCADA Expert is a Schneider Electric SCADA platform used in water, oil and gas, and utilities sectors. Exposed instances may provide unauthenticated access to industrial process data and control interfaces. !/usr/bin/env python3 -- coding: utf-8 --...

Ulterius Server < 1.9.5.0 - Directory Traversal Detection

Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs. !/usr/bin/env python3 -- coding: utf-8 -- """Ulterius Server before 1.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Apache NiFi - Information Disclosure Detection

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

Makefile - Exposure Detection

Detected Makefile configuration file was identified, which potentially exposed build process details, author information, and directory structure !/usr/bin/env python3 -- coding: utf-8 -- """Detected Makefile configuration file was identified, which potentially exposed build process details, auth...

Apache NiFi - Unauthenticated API Exposure Detection

Detects unauthenticated access to /nifi-api/process-groups/root RCE attack surface when API auth is disabled. Does not confirm command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi is designed for data streaming.""" from kittysploit import from lib.protocols.http.httpclient...

Dahua IPC/VTH/VTO - Authentication Bypass Detection

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. !/usr/bin/env python3 -- coding: utf-8 -- """The identity authentication bypass vulnerability found i...