Lucene search
+L

975306 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago7 views

Malicious code in tailwind-elements-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f8605cff87e89b9f1a50c65fc27af278335cf414a8b4fb52ea4090e9fdd71b No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libraries, which can indicate...

6.3AI score
SaveExploits0References2
NVD
NVD
added 3 days ago7 views

CVE-2026-48158

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

9.3CVSS0.00396EPSS
SaveExploits0References1
Nuclei
Nuclei
added 3 days ago68 views

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

9CVSS8.1AI score0.82165EPSS
SaveExploits4References5
Nuclei
Nuclei
added 3 days ago67 views

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

10CVSS9.6AI score0.88269EPSS
SaveExploits24References4
Nuclei
Nuclei
added 3 days ago41 views

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

8.6CVSS8.3AI score0.8056EPSS
SaveExploits0References3
Nuclei
Nuclei
added 3 days ago163 views

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

9.8CVSS8.2AI score0.95622EPSS
SaveExploits17References5
Nuclei
Nuclei
added 3 days ago79 views

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

7.8CVSS7.6AI score0.90675EPSS
SaveExploits4References5
Nuclei
Nuclei
added 3 days ago23 views

WS_FTP Server - Insecure Deserialization

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. id: CVE-2023-40044 info: name: WSFTP Server - Insecure...

10CVSS8.9AI score0.9015EPSS
SaveExploits5References5
Nuclei
Nuclei
added 3 days ago319 views

Apache OFBiz < 18.12.11 - Remote Code Execution

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery SSRF id: CVE-2023-51467 info: name: Apache OFBiz 18.12.11 - Remote Code Execution author: your3cho severity: critical description: | The vulnerability allows attackers to bypass...

9.8CVSS8AI score0.96001EPSS
SaveExploits13References5
Nuclei
Nuclei
added 3 days ago244 views

Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

9.8CVSS9.2AI score0.84116EPSS
SaveExploits8References1
Nuclei
Nuclei
added 3 days ago79 views

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

9CVSS8.8AI score0.96837EPSS
SaveExploits10References5
Nuclei
Nuclei
added 3 days ago82 views

Anyscale Ray - Remote Code Execution

Anyscale Ray 2.6.3 and 2.8.0 contain a remote code execution vulnerability due to insecure job submission API, allowing attackers to execute arbitrary code remotely if they have network access to the Ray Dashboard API. id: CVE-2023-48022 info: name: Anyscale Ray - Remote Code Execution author:...

9.8CVSS8.2AI score0.83942EPSS
SaveExploits6References6
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago13 views

Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

5.6AI score
SaveExploits0References4
CVE
CVE
added 3 days ago35 views

CVE-2026-48158

The CVE affects use-context-selector (a React useContextSelector implementation) in userland. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits that executed remote attacker-controlled code on developer machines during npm install. The commits wer...

9.3CVSS5.7AI score0.00396EPSS
SaveExploits0References1
OSV
OSV
added 3 days ago3 views

MAL-2026-13719 Malicious code in commonjs-assertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...

6.3AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago10 views

Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

5.5AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 3 days ago8 views

Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

6.3AI score
SaveExploits0References2
CVE
CVE
added 3 days ago35 views

CVE-2026-47754

CVE-2026-47754 affects Metacat 2.x (including 2.19.1) and all 1.x versions, with an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint. The bug stems from ArchiveHandler.readArchiveEntry() concatenating user input into a filesystem path and a disabled has...

9.3CVSS5.6AI score0.00338EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 3 days ago10 views

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

7.5CVSS7.4AI score0.00446EPSS
SaveExploits0References7
GithubExploit
GithubExploit
added 3 days ago18 views

react2shell-poc

React2Shell PoC CVE-2025-55182 Skrip Proof of Concept PoC...

10CVSS7.5AI score0.99616EPSS
SaveExploits383
Rows per page
Query Builder