Apollo

Apollo A simple, lightweight Remote Access Tool written in Python Apollo is a cross-platform Windows, Linux, FreeBSD & MacOS Remote Access Tool for Python 3.4+. Its features are currently very basic but allow for post-exploitation remote code execution as well as obtaining information on the clie...

mythic_telegram_profile

Telegram C2 profile for Mythic Telegram provides a Mythic C2 profile for the Athena and Apollo agents. It uses Telegram private bot-to-bot messages as a transport and Mythic's Push C2 gRPC service as the controller bridge. Architecture Athena or Apollo agent bot Telegram Bot API controller bot...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

Malware in @factoryz/apollo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

POC-CVE-2026-32621-Apollo-Federation-XSS-Vulnerability

CVE-2026-32621 - Apollo Federation Prototype Pollution PoC Overview Field| Value ---|--- CVE| CVE-2026-32621 CVSS| 9.9 Critical CWE| CWE-1321 Prototype Pollution Affected| Apollo Federation 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2 Patched| 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2 GHSA|...

apollo-koa-minimal

CVE-2023-26144...

GraphCrawler

GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...

Malicious Package

Overview @factoryz/apollo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @factoryz/apollo (npm)

Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS URL...

MAL-2026-18278 Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-109302: Incorrect Authorization

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, apollo-router, vector, ntpd-rs, shadowsocks-rust, sccache, komodo...

GHSA-6F2X-V7Q7-M7M5 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, apollo-router, vector, ntpd-rs, shadowsocks-rust, sccache, komodo...

GHSA-5J98-2G5X-46V6 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, apollo-router, vector, ntpd-rs, shadowsocks-rust, sccache, komodo...

WyreStorm Apollo VX20 Config Leak (CVE-2024-25735)

Exploits CVE-2024-25735 in WyreStorm Apollo VX20 1.3.58: unauthenticated GET /device/config exposes SoftAP router credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """WyreStorm Apollo VX20 config leak CVE-2024-25735.""" from kittysploit import from lib.protocols.http.httpclient impor...