CVE-2019-16941

CVE-2019-16941 概念実証（PoC）： この脆弱性は、トリガーされるために複数の比較的起こりにくい条件を必要とするため、その悪用可能性は限定されます。しかし、任意のコード実行につながる可能性があるため、ペイロードの準備には少しの労力と理解しか必要ありません。 ペイロードの作成： ターゲットに実行させるペイロードを作成するには、Ghidraに組み込まれているスクリプトを使用できます。これにアクセスするには、「Window」→「Script Manager」をクリックし、Code...

Umbrella

Umbrella Dropper Copyright 2017 Umbrella 作者： Alisson Moretto - 4w4k3 Umbrella 是一款专用于渗透测试的文件投放器，它能在目标系统上下载文件并执行，无需重复执行 exe 文件，仅通过嵌入式方式执行。 要再次入侵同一目标，你需要删除目标系统上的此文件夹： - C:\Users\Public\Libraries\Intel - 因为投放器会检查该文件夹是否存在，以决定下一步操作。 Twitter: @4w4k3Official 免责声明：...

CVE-2026-66060 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...

CVE-2026-48098

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

MAL-2026-13294 Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bf90f9ba8f401c6300846c2e5fa3af2afd241fba5d967300272a8dc7eadec7 On require of bnpl-blocks-atom-container, index.js loads adapter.js which selects a platform-specific target path, downloads an opaque binary from on...

MAL-2026-12304 Malicious code in twork-mf-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c6ce8fa08d31308e00adae0366018f14c4518e234073d99b996212b82cfccd1 On require of twork-mf-sandbox, index.js loads bridge.js which downloads a platform-specific native binary from a rotating list of anonymous Cloudfla...

Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

MAL-2026-6343 Malicious code in thidweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80721058923b3e5963a6ee170007b8b4131ae5093481456ca10e63f52963987d Package is published as thidweb but its README, source comments, repo URL, and author metadata all identify it as big.js v7.0.1 by Mike McLaughlin...

MAL-2026-5884 Malicious code in vortnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b7aa0683f0462d98c9ab789942e329e1298af3f85c0bd3a9b3761f5aebf8fb On npm install, the preinstall hook node lib/setup.js runs on Windows and invokes lib/worker.js, which downloads an executable to %LOCALAPPDATA%\Temp...

Malicious code in vortnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b7aa0683f0462d98c9ab789942e329e1298af3f85c0bd3a9b3761f5aebf8fb On npm install, the preinstall hook node lib/setup.js runs on Windows and invokes lib/worker.js, which downloads an executable to %LOCALAPPDATA%\Temp...

MAL-2026-5800 Malicious code in boardstep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d23139a90bc62310843522a9f8c266cf11ec4166f7a493072bf93b7d8ec05b0c The package wires all three npm lifecycle hooks preinstall, install, postinstall in package.json to run install.js, which downloads...

Embedded Malicious Code

Overview @jagreehal/workflow is a Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support. Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious...

Malicious code in foundry-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9f62cf5a646cd39640b2be03720a6a2195dc4924813146e9a0d387bafa75c7de In specific environments, the package triggers silent code execution during installation. The code to execute is not included in the package. --- Category:...

Malicious code in pyenvprep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 963727b60e7fa8536050eb0f4691dc8bec6089567630063305d05ddceb4834cd Package contains code to silently execute a RAT-like agent, allowing the attacker to access the file system and execute arbitrary code. --- Category: MALICIOUS...

MAL-2026-3803 Malicious code in venv-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9af11c23295a9a592b6fd62d62490669a752ab6dc6c0b755ebd068ec6371375f Package contains code to silently execute a RAT-like agent, allowing the attacker to access the file system and execute arbitrary code. --- Category: MALICIOUS...

CVE-2026-40111

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell...

CLSA-2025-1745596088 libreoffice: Fix of CVE-2023-6186

CVE-2023-6186: validate macro permissions to prevent execution without warning...

Malicious code in harthat-chain (npm)

The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...

CVE-2019-9848

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrar...