CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS (specifically qubes-core-dom0-linux before 4.3.22 ) is vulnerable to OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube. The root cause is the use of the system() library function in core-admin-linux/file-copy-vm/qfile-dom0-agent.c to process an er...

EUVD-2026-68212

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

Exploit for CVE-2026-76581

CVE-2026-76581 Donate Help maintain this p...

CVE-2026-82635

Pake before 3.13.1 is vulnerable to arbitrary file write via its download_file Tauri command. The JavaScript-supplied filename is joined onto the user's Downloads directory without sanitization, so a filename containing path traversal sequences or an absolute path resolves outside ~/Downloads. Th...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

EUVD-2026-68199

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

watermarks-remover v0.5.0

root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...

nushell v0.115.0

Nushell A new type of shell. Table of Contents Status Learning About Nu Installation Configuration Philosophy Pipelines Opening files Plugins Goals Officially Supported By Contributing License Status This project has reached a minimum-viable-product level of quality. Many people use it as their...

frp v0.71.0

frp README | 中文文档 Sponsors frp is an open source project with its ongoing development made possible entirely by the support of our awesome sponsors. If you'd like to join them, please consider sponsoring frp's development. Gold Sponsors The complete IDE crafted for professional Go developers The...

poc_validator

PoC Validator Problem curl's bug bounty program was closed...

hermes-agent v2026.8.18

Hermes Agent ☤ Hermes Agent | Hermes Desktop The self-improving AI agent built byNous Research. It's the only agent with a built-in learning loop — it creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a...

openclaw v2026.8.1-beta.2

OpenClaw 🦞 — Your assistant, on your devices, in your chats OpenClaw is an AI assistant that runs on your devices and meets you in the channels you already use. It connects models, tools, messaging channels, and optional companion apps through one Gateway, for a single operator or for a team whos...

SiemX

SIEM-X A lightweight Security Orchestration, Automation, an...

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix , that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same techniq...

Malicious code in auth-app-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-15577 Malicious code in auth-app-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...