CVE-2021-44168

Exploit for CVE-2021-44168 Purpose Exploit CVE-2021-44168 to drop a shell on a Fortigate firewall and enable its access via LDPRELOAD tricks that execute when running some of Fortigate's CLI commands. You get a root shell. Use Compile: root@kitploit: gcc -o gensrc-vispkgfile gensrc-vispkgfile.c -...

CVE-2026-42574

The CVE-2026-42574 issue affects apko dirFS used to build/publish OCI images. A crafted APK could place a TypeSymlink tar entry whose target points outside the build root, enabling traversal to host paths via subsequent directory creation or write operations within the same or later archive. Root...

rust-rpm-sequoia: rust-rpm-sequoia: Denial of Service via crafted RPM file during signature verification

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...

CVE-2026-2625

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...

CVE-2026-2625 Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malicious code in spectron-flare-css-loader-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a3021cdbe1ba768aeed367daffaba3184d09ca0b1076ec3c8fe83fc378143f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stop-prompts-fusion-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a369d5bd92a84f0b2a7db8c2040c883f375e842eb37e42b4aeac8b102ff0f006 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centaurus-quasar-module-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29e050252b3c774ca548dd99315e0f8c4a20a46b58ff9253a699a09e756ea1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cybernetics-selenology-local-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45900616fd9126bd090f5865bdf4a028806e11b2380fee63848bb099345c6c7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-betelgeuse-halley-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0d3a2b6835a2e2cd78eb315d5e4b82e68d0bcb3840274c62bda761b9496ffe3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in finally-validate-spy-transpile-scale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9042f0ca03575eae11d95191fb56e4a493c9d9cc6f78b44ff5664df90a5eae0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pipe-cz-conventional-changelog-meissa-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f76581a30ce1561ccc8aff0c4f6f3ecc981e5d814d26ad12af5b54f32937a161 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuxtjs-hugo-karma-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79556a4b1006c3aa3f897ef9fccba95b8e8d674b5863c91df3f26f4e762b507a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...