Malicious code in crypto-mnemonic-tools (RubyGems)

Source: amazon-inspector 20550e421f034d2bf7c4ca653a79a2558f3d84a49a54566e874d92cc80557469 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++ sources; createmakefile produces an empty build so the extconf.rb exists solely to execute code at gem install time. T...

Malicious code in bitcoin-rpc-lite (RubyGems)

Source: amazon-inspector 4567a3469d6774fbe9be233375145274adf41f8e7a20521724a9a15606351044 The gem declares ext/reqthrottlemini/extconf.rb as a native extension, but the ext/ directory ships no C/C++/Rust sources — the extension manifest exists solely to execute Ruby code during gem install. The...

MAL-2026-17587 Malicious code in bitcoin-rpc-lite (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in bitcoin-rpc-lite (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97165

The Joomla Extension - svenbluege.de - Event Gallery extension versions prior to 6.5.0 is vulnerable to Reflected XSS and open redirect . The root cause is that the "return" parameter is base64-decoded and written directly to the "Back" link without sufficient validation. This could allow an atta...

EUVD-2026-87928

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

PT-2026-76513

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

PT-2026-76511

The NIP-44 decryption entry point Base64-decoded the complete attacker-controlled payload before determining its version or enforcing any size limit. For v2 payloads, the decoded buffer was then authenticated with HMAC even when it was much larger than the maximum payload supported by the crate's...

CVE-2026-49867: Improper Neutralization of Input During Web Page Generation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

MAL-2026-10202 Malicious code in chain-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5 The package's declared main entry index.js exports a factory check that spawns a detached, unreferenced Node child process running lib/vcall.js, then...

Unix File Writer (via Python)

Write base64-decoded content to a local file without opening a network connection from kittysploit import class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix File Writer via Python', 'description': 'Write base64-decoded content to a local file without opening a network connection'...

CVE-2026-6279 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

The Avada Builder fusion-builder plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the wpconditionaltags case in FusionBuilderConditionalRenderHelper::getvalue passing attacker-controlled...

Embedded Malicious Code

Overview @velora-dex/sdk is a SDK for the Velora API Affected versions of this package are vulnerable to Embedded Malicious Code that delivers a malicious payload through dist/index.js. An attacker uploaded a compromised version of the package directly to the npm registry. The payload runs a...

CVE-2022-0150

The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...

CVE-2024-32662 FreeRDP rdp_redirection_read_base64_wchar out of bound read

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when WCHAR string is read with twice the size it has and converted to UTF-8, base64 decoded. The string is only used to compare against t...

CVE-2024-22024

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication. Recent assessments: cbeek-r7 at February 09, 2024 3:26pm UT...

CVE-2022-26964

Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded...

CVE-2021-38346

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...

Directory traversal

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...