Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

phone-deck

phone-deck 将闲置的安卓手机（或任何带浏览器的设备）变成你 Linux 工作站的自主托管控制台和远程桌面——通过你的私有 Tailscale 网络，无需第三方应用。 它始于“拿旧手机能做什么？”，最终演变为一个 Hyprland 设备的控制平面：窗口/工作区控制、场景宏、带本地 LLM 助手的按键通话语音路由、上下文感知的应用内控制、双向音频+屏幕流式传输、触控远程桌面、虚拟键盘/鼠标、文件传输+手机到电脑共享，以及实时遥测——所有这些都通过一个已安装的 PWA 提供服务，外观为磷光终端风格。 关于可移植性的说明。 这是为特定配置构建的：基于 Arch 的...

Bugs-feed

Bug's feed Bug's feed 是一个本地托管的门户，你可以在其中搜索最新的新闻、视频、CVE、漏洞……它实现为 PWA 应用，因此你可以摆脱浏览器，直接将其用作桌面应用。浏览不同的标签页，查看最新的漏洞，或者一次性在所有标签页中搜索。它还带有一个配置面板，你可以在其中自定义标签和视频频道。 🐝 关于项目 ⚠️ 这是我的第一个大型项目。它并不完美，需要改进。请参阅贡献指南。 作为一名黑客和开发爱好者，我喜欢为自己制作最新漏洞的脚本。 问题： 外界信息浩如烟海。每天都有大量新漏洞被发现，无数相关的推文被写出，相应的视频也被录制。 解决方案：...

sigint

SIGINT 实时开源情报仪表盘，在互动式地球仪上显示实时飞机、船只、地震、火灾、天气和事件跟踪。使用 Bun、React 19 以及自定义 Canvas 2D + Web Worker 渲染引擎构建。可作为 PWA 安装。 截图 目录 SIGINT 截图 目录 功能特性 实时数据 情报能力 可视化 平台 安装 快速开始 环境变量 数据源 测试 部署 开发 生产 使用 TLS 的生产环境 Heroku 清理 PWA 文档 许可证 作者 功能特性 实时数据 飞机跟踪（adsb.fi） AIS 船只跟踪（aisstream.io） 地震监测（USGS） 火灾热点检测（NASA FIRMS）...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in PWA implementations in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent, through a crafted HTML page. Chromium security severity: Medium...

Malicious code in tinkoff-pwa-confac-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembl...

Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

MAL-2026-6969 Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

CVE-2026-54352

Budibase has a high-severity arcane file-read issue via the PWA ZIP upload endpoint. Prior to 3.39.9, a workspace-builder could upload a ZIP containing a symlink to a root-available file (for example, /data/.env or /etc/shadow) and, because extract-zip preserves absolute targets and the icon vali...

Malicious code in vite-config-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58 [email protected] impersonates the legitimate vite-plugin-pwa package README copies its banner/badges, funding field points at antfu's GitHub...

signal-echo-radar

Signal Echo Radar Signal Echo Radar is a static cybersecurity...

Linux Distros Unpatched Vulnerability : CVE-2026-5892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a...

CVE-2026-5892

CVE-2026-5892 affects Google Chrome/Chromium PWAs. The root cause is insufficient policy enforcement for PWAs in the renderer, allowing a remote attacker who had compromised the renderer to install a PWA without user consent via a crafted HTML page. Affected versions are prior to 147.0.7727.55 (C...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

Malicious Package

Overview shakti-pwa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-2100 Malicious code in shakti-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdac10e664bf4e0a73263401629caf12d2ed80e3cf76f36fa18a7c2d599e5229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shakti-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdac10e664bf4e0a73263401629caf12d2ed80e3cf76f36fa18a7c2d599e5229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-30240

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA Progressive Web App ZIP processing endpoint POST /api/pwa/process-zip allows an authenticated user with builder privileges to read arbitrary...