CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

EUVD-2026-67859

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

PT-2026-83240

Name of the Vulnerable Software and Affected Versions JS Recon versions 1.2.1-beta.1 through 1.3.1-beta.1 Description The PR Branch Checker workflow in .github/workflows/pr checker.yml improperly handles untrusted values. Specifically, the github.head ref and github.event.pull...

CVE-2026-55378: Improper Neutralization of Special Elements used in an OS Command

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

HAKIMIX

HAKIMIX Framework 🛡️🔥 HAKIMIX waa Framework awood badan o...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

bbot v3.0.2

BEE·bot is a multipurpose scanner inspired by Spiderfoot, built to automate your Recon , Bug Bounties , and ASM! https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81 A BBOT scan in real-time - visualization withVivaGraphJS Installation root@kitploit:...

recon-cockpit

ReconCockpit A desktop cockpit that turns a penetration-testi...

claude-bug-bounty v6.0.0

BugHunter AI-powered bug bounty hunting — recon to report, in your terminal. Free Setup · Quick Start · Commands · What It Finds · Install · FAQ !AwareXonehttps://assets.kitploit.com/production/public/readmes/65/29e21784cbe8b37142a688801ddd02d4084136effa303a59c67cdd8...

mcp-recon

MCP Recon Secure, modular MCP server wrapping 7 pentesting...

Conferences bhusa2026

Conferences Conference presentation slides: BlackHat USA 2025 August 2-7 Offensivecon 2025 May 16-17 Black Hat Asia 2025 1-4 April Black hat Europe 2024 9-12 December Hexacon 2024 Slides 4-5 October Black Hat USA 2024 slides 3-8 August REcon 2024 Slides 28-30 Jun Offensivecon 2024 May 10-11...

MAL-2026-14279 Malicious code in localize-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...

MAL-2026-14196 Malicious code in tfjs-custom-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74 tfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script that runs automatically on...

CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-75104

Hugging Face Transformers joins shard filenames from checkpoint index files without validation, allowing malicious index files with parent-directory references or absolute paths to read arbitrary files outside the model directory. CVSS 6.8 (medium) requires local access and user interaction. No p...