Malicious code in classlink-gvxxr7vn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de13feca259c056b95a24ee4dc73ca154645e1bad2e0a4e1a20d47decda824d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15253 Malicious code in desmos-graphing-xuxzyx1y (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f638d4cbcf804a45fda60d1a3f03f60bdbd247bf1bd1338730c291f9731c1f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15182 Malicious code in classlink-yiqm3f92 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6187bc2ab8a282c55b85f5aedb706bca6649a971b7d721af1a8e53026bd1820f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15130 Malicious code in classlink-qrvgupip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72cd08c43e170ff12e4ca338187ad2d47154b369019ea0f7f6e53498d0c0ac14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15266 Malicious code in secure-test-browser-1yjarnvk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7995072543002e808e597ccfd49ae3d1497ac3073f3afddee765664f8cfc446b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MSC-2026-11521

Malicious package. setup.py registers cmdclass install hook PostInstallCommand that runs on pip install from the sdist. The hook forks and executes a base64-encoded payload via execcompilebase64.b64decode..., with a subprocess.Popen fallback and all failure paths silenced. The payload exfiltrates...

EUVD-2026-67678

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

winrar-exploit

Descrizione Questa è la mia implementazione dell'exploit CVE-2025-8088 per Winrar. Utilizza Alternate Data Streams ADS e il path patching all'interno dell'archivio. Quando una vittima estrae l'archivio infetto, il payload ADS patchato ad es., eseguibile, script powershell o qualche png divertente...

CVE-2025-62343

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

SUSE CVE-2026-51106

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component...

CVE-2026-81826 Flowintel Fails to Invalidate Active Sessions After Password Change

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

CVE-2025-62343 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2025-62343 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2025-62343

HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability that may allow user sessions to remain active after logout or session deletion. The assigned CVSS 3.1 score is 3.1 (LOW) , reflecting a network attack vector with high complexity and required user inte...

CVE-2026-41730

CVE-2026-41730...

CVE-2026-81826: Insufficient Session Expiration

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

CVE-2026-51106

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component...

When AI infrastructure becomes the target: Securing gateways and control points

In this article 1. AI workloads are becoming high-value control points 2. Case study 1: LiteLLM gateway compromise 3. Case study 2: RAGFlow compromise 4. Case study 3: Kestra compromise 5. Mitigation and protection guidance 6. MITRE ATT&CK techniques observed 7. References 8. Learn more AI is...