CVE-2026-109349: Reachable Assertion

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

PT-2026-110768

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description An uncontrolled memory allocation issue exists where remote attackers can cause a process to abort. By providing a 12-byte pack header that claims 0xFFFFFFFF objects, a malicious remote ca...

PT-2026-110766

Name of the Vulnerable Software and Affected Versions gitoxide gix-pack versions prior to 0.75.0 Description A reachable assertion exists in the BytesToEntriesIter::new from header function. While the pack header decoder accepts version 3, a release-enabled assert eq! requires version 2. A...

PT-2026-110767

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description A denial of service issue exists where malicious remotes can crash fetch operations by sending crafted thin-pack OFS DELTA entries. An attacker can provide a thin pack containing a REF DEL...

Medium: perl

Issue Overview: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk. When such branches are combined into a trie, the delta between the first branch and the shared...

pack

Password Analysis and Cracking Kit de Peter Kacherginsky iphelix PACK Password Analysis and Cracking Toolkit es una colección de utilidades desarrolladas para ayudar en el análisis de listas de contraseñas con el fin de mejorar el descifrado de contraseñas mediante la detección de patrones de...

Malicious Package

Overview kmf-vendor-pack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in kmf-vendor-pack (npm)

Source: amazon-inspector 95ddc660098b1c73a1899ad3fe471b53ce562ca033669fa64622ff386d774129 package.json defines a postinstall script that invokes node -e to issue an HTTPS GET to the attacker-controlled out-of-band callback host db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro, embedding the installer's...

MAL-2026-17744 Malicious code in kmf-vendor-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6e1c289f2890e0e06ab31a8d6cf5dbc8deabc26054cb44a0c60295c29a74506 [email protected] is a dependency-confusion lure. package.json declares postinstall: node postinstall.js, which requires a shipped prebuilt...

Malicious code in kmf-vendor-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6e1c289f2890e0e06ab31a8d6cf5dbc8deabc26054cb44a0c60295c29a74506 [email protected] is a dependency-confusion lure. package.json declares postinstall: node postinstall.js, which requires a shipped prebuilt...

Malicious Package

Overview hardhat-pack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17661 Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

CVE-2026-105873

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

CVE-2026-105871

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

CVE-2026-105873 WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

CVE-2026-105873

The BdThemes Element Pack Elementor Addons plugin (bdthemes-element-pack-lite ) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) . This vulnerability, identified as CWE-79 , stems from the improper neutralization of input during web page generation . The issue affects versions thr...

EUVD-2026-94249

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

CVE-2026-105873 WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Element Pack Elementor Addons versions = 8.8.6...