sigint

SIGINT 实时开源情报仪表盘，在互动式地球仪上显示实时飞机、船只、地震、火灾、天气和事件跟踪。使用 Bun、React 19 以及自定义 Canvas 2D + Web Worker 渲染引擎构建。可作为 PWA 安装。 截图 目录 SIGINT 截图 目录 功能特性 实时数据 情报能力 可视化 平台 安装 快速开始 环境变量 数据源 测试 部署 开发 生产 使用 TLS 的生产环境 Heroku 清理 PWA 文档 许可证 作者 功能特性 实时数据 飞机跟踪（adsb.fi） AIS 船只跟踪（aisstream.io） 地震监测（USGS） 火灾热点检测（NASA FIRMS）...

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

Bugs-feed

Bug's feed Bug's feed はローカルでホストされるポータルで、最新のニュース、動画、CVE、脆弱性などを検索できます。 PWA アプリケーションとして実装されているため、ブラウザを離れてデスクトップアプリケーションとして使用できます。 さまざまなタブを移動して最新のバグを確認したり、すべてを一度に検索したりできます。 設定パネルも付属しており、ハッシュタグや動画チャンネルを自分好みに変更できます。 🐝 このプロジェクトについて ⚠️ これが私の初めての大きなプロジェクトです。完璧ではなく、改善が必要です。Contributing を参照してください。...

phone-deck

phone-deck 余っているAndroidスマートフォン（またはブラウザを搭載した任意のデバイス）を、自己ホスト型のコントロールデッキおよびリモートデスクトップに変身させます。プライベートなTailscaleネットワーク上で、サードパーティ製アプリは不要です。...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in PWA implementations in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent, through a crafted HTML page. Chromium security severity: Medium...

Malicious code in tinkoff-pwa-confac-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembl...

Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

MAL-2026-6969 Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

CVE-2026-54352

Budibase has a high-severity arcane file-read issue via the PWA ZIP upload endpoint. Prior to 3.39.9, a workspace-builder could upload a ZIP containing a symlink to a root-available file (for example, /data/.env or /etc/shadow) and, because extract-zip preserves absolute targets and the icon vali...

Malicious code in vite-config-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58 [email protected] impersonates the legitimate vite-plugin-pwa package README copies its banner/badges, funding field points at antfu's GitHub...

signal-echo-radar

Signal Echo Radar Signal Echo Radar is a static cybersecurity...

Linux Distros Unpatched Vulnerability : CVE-2026-5892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a...

CVE-2026-5892

CVE-2026-5892 affects Google Chrome/Chromium PWAs. The root cause is insufficient policy enforcement for PWAs in the renderer, allowing a remote attacker who had compromised the renderer to install a PWA without user consent via a crafted HTML page. Affected versions are prior to 147.0.7727.55 (C...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

Malicious Package

Overview shakti-pwa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-2100 Malicious code in shakti-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdac10e664bf4e0a73263401629caf12d2ed80e3cf76f36fa18a7c2d599e5229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shakti-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdac10e664bf4e0a73263401629caf12d2ed80e3cf76f36fa18a7c2d599e5229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-30240

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA Progressive Web App ZIP processing endpoint POST /api/pwa/process-zip allows an authenticated user with builder privileges to read arbitrary...