CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CVE-2026-51990

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

shlol

SHLOL This is a menu you can trigger with a keybind to do basic stuff for you Really easy to use Create listeners on the fly No copy pasting needed Choose the type, IP and PORT and you are done! Run remote scripts easily Reverse Shell Generator...

Malicious code in testing1345 (PyPI)

Source: kam193 15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd During installation, the package downloads and executes a script from a remote location. The server delivers different payload versions, some of them being benign, and others containing next-stage installation. The...

Malicious code in testing1345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd During installation, the package downloads and executes a script from a remote location. The server delivers different payload versions, some of them being...

Malicious code in garvisometerui (PyPI)

Source: kam193 09877eb0403bbdcc0057b40370627c99965eaf5b4d8215cc4b23ea8c089bc9b8 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in voxcpmttslora (PyPI)

Source: kam193 b40228df9bac54fb38c660c1a82e16e409a25f416bdd35e4d50339abf8891f2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in qwen3ttsui (PyPI)

Source: kam193 2c64f86bb29e534513cdf30a837f2ff458b45eac42c8e35f191b952481ef7c3f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in dashloom (PyPI)

Source: kam193 ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909 This package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling pydash.invoke.... The code to reach it is intended to...

Malicious code in acustoviasr (PyPI)

Source: kam193 1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.78 packages and security update

Red Hat OpenShift Container Platform release 4.14.78 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Malicious code in logger-libs (PyPI)

Source: kam193 b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55 In this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location. --- Category: MALICIOUS - The...

Malicious code in logger-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b The package publishes under a name resembling the legitimate log-utils/loggerutil library README imports loggerutil.helper, setup.py url points at...

MAL-2026-18778 Malicious code in logger-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b The package publishes under a name resembling the legitimate log-utils/loggerutil library README imports loggerutil.helper, setup.py url points at...

Malicious code in twitch-stream-py (PyPI)

Source: kam193 bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by...