web-check

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: NinjaPear API to get a full B2B profiles from any URL | Hostinger Deploy Web-Check with one click on Hostinger | Warp Built for coding with multiple AI agents ---|---|--- Contents About...

chain-reactor

Chain Reactor Chain Reactor es una herramienta de código abierto para probar la cobertura de detección y respuesta en máquinas Linux. La herramienta genera ejecutables que simulan secuencias de acciones como la creación de procesos y la conexión de red. Chain Reactor no asume experiencia previa e...

LeitWacht

GitLab Runner Leitwacht Control de salida de red para contenedores CI/CD de GitLab Runner. Leitwacht previene ataques a la cadena de suministro que exfiltran secretos, controlando lo que cada contenedor de trabajo puede acceder en la red. Cómo Funciona Leitwacht es un agente independiente que se...

react2shell

React2Shell: RCE 0-day nei React Server Components CVE-2025-55182 React e CVE-2025-66478 Next.js Questo repository contiene codice exploit per test di sicurezza autorizzati e solo a scopo educativo. Vedi anche: Molti ricercatori hanno pubblicato analisi di questa vulnerabilità. Controlla la sezio...

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel,...

Malicious code in @tunstock/remact-dom (npm)

Source: amazon-inspector 32b1034bbfcc4ab6831b76348d4e6c18e427f283ae1cf1661d31f282a3416da8 Package @tunstock/remact-dom is a typosquat of react-dom and ships a postinstall script scripts/setup.js that runs automatically on npm install. The script collects os.hostname, os.platform, os.arch, Node...

Malicious code in @tunstock/remact-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b1034bbfcc4ab6831b76348d4e6c18e427f283ae1cf1661d31f282a3416da8 Package @tunstock/remact-dom is a typosquat of react-dom and ships a postinstall script scripts/setup.js that runs automatically on npm install. The...

MAL-2026-17745 Malicious code in @tunstock/remact-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b1034bbfcc4ab6831b76348d4e6c18e427f283ae1cf1661d31f282a3416da8 Package @tunstock/remact-dom is a typosquat of react-dom and ships a postinstall script scripts/setup.js that runs automatically on npm install. The...

CVE-2026-101894

A flaw was found in the @xhmikosr/decompress and decompress packages for Node.js. The default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

Understanding Verification Vulnerabilities in Cross-Chain Bridges: An Empirical Study

With the rapid development of blockchain technology, numerous heterogeneous blockchains have emerged, each featuring distinct architectures, consensus mechanisms, and application ecosystems. Cross-chain bridges have consequently become a critical infrastructure component, typically relying on sma...

CLSA-2026-1791497901 gnutls: Fix of CVE-2026-42011

CVE-2026-42011: a CA carrying only excluded name constraints, or permitted ones of another name type, no longer causes the permitted name constraints of a CA below it to be dropped during chain verification. This corrects the els1 entry: 3.3.29 is affected through the APPEND path of...

CLSA-2026-1791497467 gnutls: Fix of CVE-2026-42011

CVE-2026-42011: a CA carrying only excluded name constraints, or permitted ones of another name type, no longer causes the permitted name constraints of a CA below it to be dropped during chain verification. This corrects the els1 entry: 3.3.29 is affected through the APPEND path of...

CLSA-2026-1791496727 gnutls: Fix of CVE-2026-42011

CVE-2026-42011: a CA carrying only excluded name constraints, or permitted ones of another name type, no longer causes the permitted name constraints of a CA below it to be dropped during chain verification. This corrects the els1 entry: 3.3.29 is affected through the APPEND path of...

woocommerce-plugin-supply-chain-security-assessment

CVE-2026-49777 - WooCommerce Product Slider Pro: Impianto di Software Malevolo e RCE Report di Cybersecurity in Stile Consulenziale Report professionale di valutazione della vulnerabilità per il rischio della supply chain del plugin WooCommerce, inclusi impatto aziendale, remediation e strategia ...

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit SDK for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credential...

MAL-2026-17658 Malicious code in hardhat-bits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e10f22980d33eea7649312f6b2b0a94637e5b4da400f7d585c58b6902a77944 The package is published as hardhat-bits but its README, LICENSE, docs/, and lib/ files are copied verbatim from the pino logger project, providing...

Malicious code in hardhat-bits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e10f22980d33eea7649312f6b2b0a94637e5b4da400f7d585c58b6902a77944 The package is published as hardhat-bits but its README, LICENSE, docs/, and lib/ files are copied verbatim from the pino logger project, providing...

CLEANSTART-2026-GR33077 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

CVE-2026-32281 affects multiple packages. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details...

CLEANSTART-2026-JP32193 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

CVE-2026-27137 affects multiple packages. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint wil...

Embedded Malicious Code

Overview tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the...