punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

CVE-2023-34039

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight Static SSH key RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ Summary VMWa...

secretive

Secretive Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Why? Safer Storage The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy...

CVE-2026-109965

Serena versions before 2.0.0 are vulnerable to an improper link resolution vulnerability (CWE-59). The root cause is that Project.is_path_in_project() normalizes paths lexically without resolving symlinks. This allows an attacker to commit symlinks inside a repository to access, read, or overwrit...

CVE-2020-12116

CVE-2020-12116 Proof of concept code to exploit CVE-2020-12116: Unauthenticated arbitrary file read on ManageEngine OpManger. Summary The latest release of OpManger contains a directory traversal vulnerability that allows unrestricted access to every file in the OpManager application. This includ...

trommel

TROMMEL TROMMEL sifts through embedded device files to identify potential vulnerable indicators. TROMMEL identifies the following indicators related to: Secure Shell SSH key files Secure Socket Layer SSL key files Internet Protocol IP addresses Uniform Resource Locator URL email addresses shell...

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

Linux Distros Unpatched Vulnerability : CVE-2026-91148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Automatic update for cockpit-368-1.fc45. Changelog for cockpit Wed Sep 23 2026 Packit - 368-1 - Limit concurrent connections CVE-2026-91149 - Harden cockpit-ws...

CVE-2026-82929

The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...

CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

MAL-2026-17161 Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

secretive v4.0.0

Secretive Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Why? Safer Storage The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy...

brutus v1.15.0

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

Malicious code in gmgn-trading-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...

MAL-2026-16096 Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

CVE-2026-73678

CVE-2026-73678 enables unauthenticated remote code execution in MindsDB Minds Platform

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

MAL-2026-13775 Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...