91588 matches found
flagyard-ctf-writeups-
BlogHub Exploit Kit Flagyard Training Labs - Web / Medium / 1...
Malicious code in arbocrate-sla-prober-arbocrate-sla-prober-core (npm)
Source: amazon-inspector 34a4b9e0346198bed7019ba0bba4e32036dad95c22d83159b22ab5e9920bd8f0 On require of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...
CVE-2025-0401
CVE-2025-0401 - Local Privilege Escalation via SUID Binary Abuse Summary CVE-2025-0401 is a local privilege escalation vulnerability discovered in systems where the /usr/bin/passwd binary is misconfigured, allowing unintended root-level access when combined with specific syscall sequences. This...
CLSA-2026-1788335736 Fix of 13 CVEs
SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in addimpliedinclude from a files-from entry carrying both an interior and a trailing backslash: - debian/patches/els/0009-CVE-2026-70461.patch: count a trailing backslash when sizing the appended-wildcard pattern. - CVE-2026-70461...
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution RCE exploit from one WAGO programmable logic controller PLC to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targetsCVE-2021-31886 , a...
Arbitrary Code Execution
NLTK is vulnerable to arbitrary code execution. The vulnerability is due to the use of unvalidated relative or bare-name paths when invoking the Graphviz dot binary, which allows an attacker to execute arbitrary code by placing a malicious dot executable in the current working directory or in a...
Malicious code in chromatitle-dev (npm)
Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941 src/index.js unconditionally calls bootstrap at module load. On win32, src/utils/bootstrap.js base64-decodes a URL, filename, and staging directory stored in an S object and decoded via...
secretlint v13.0.5
Secretlint Secretlint is a Pluggable linting tool to prevent committing credentials. Features Scanner : Find credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook : Prevent committing credential files Pluggable : Allow...
nah v1.4.0
expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it compares • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool call...
gotatun v0.9.2
GotaTun A userspace WireGuard® implementation, and a fork of BoringTun. License All source code in this repository is subject to the terms of the Mozilla Public License, version 2.0 unless stated otherwise. A copy of this license can be found in the file "LICENSE" or at...
bitbang-cli v0.5.0
BitBang CLI bitbang is a single static binary remote-access multitool. From any browser: an interactive shell and file browser access to the remote machine. You can also reach web apps on that machine's network. Beyond the browser, it does TCP port forwarding, file copy, and terminal sharing. It...
vault v2.1.0
Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...
[SECURITY] Fedora 43 Update: bubblewrap-0.12.0-1.fc43
Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces...
PT-2026-84758
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...
Ghost_CMS 6.19.0 - Remote Code Execution
Exploit Title: GhostCMS 6.19.0 - Remote Code Execution Date: 08/07/2026 Exploit Author: Maksim Rogov Vendor Homepage: https://ghost.org/ Software Link: https://ghost.org/ Version: = 0.7.2, 'Ghost CMS Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution RCE...
CVE-2026-53611: Improper Neutralization of Special Elements used in an OS Command
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...
MAL-2026-15814 Malicious code in chromatitle-dev (npm)
The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...
Malicious code in chromatitle-dev (npm)
The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...
Can Risk-Based Alerting Mitigate Cybersecurity Alert Fatigue?
Security operations centers SOCs face large numbers of false alerts, making detection of cyberattacks difficult under typical resource constraints. Risk-based alerting RBA has been proposed as a means to reduce false alerts and has reportedly succeeded in doing so in various enterprise deployment...
