123150 matches found
PEASS-ng v20260715-81d3c7f8
PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...
Malicious code in @debile/require-dir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script ru...
Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
MAL-2026-10634 Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
CVE-2026-38753
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
PT-2026-60142
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78 Description A remote code execution issue exists in the run skill script function within SkillTools. The function accepts a script path parameter and executes it using subprocess.run without performing path...
CVE-2026-38753: Use After Free
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
PT-2026-60312
Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A stack overflow occurs in the evaluate function editors/awk.c when processing a specially crafted AWK script, which can lead to a Denial of Service DoS. A stack overflow is a condition where...
CVE-2026-38753
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-26718
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application, affecting versions prior to 3.4.0 (specifically noted in version 3.0.0). The flaw stems from an endpoint that lacks proper CSRF token validation and utilizes a permissive request mapping that accepts ar...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38753
A use-after-free vulnerability exists in the awk_sub() function (located in editors/awk.c ) of Busybox v1.38.0 . This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted AWK script . While some sources indicate the vulnerability may not have a vendor-supplied patch...
CVE-2026-38752
The BusyBox package (specifically versions less than 1.36.1-26 ) is vulnerable to a stack overflow in the evaluate() function of editors/awk.c (commit 371fe9). An attacker can exploit this by supplying a crafted AWK script to trigger a Denial of Service (DoS) . A patched version of the package is...
ROS-20260715-73-0023
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to deficiencies in access control in isolated environments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260715-73-0022
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to deficiencies in access control in isolated environments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...