sshroute v0.2.12

sshroute CI| Code| OpenSpec| Security ---|---|---|--- | | | Net...

CVE-2025-71408

A flaw was found in NLTK Natural Language Toolkit. This eval injection vulnerability in the nltk.collocations module allows a local attacker to execute arbitrary Python code. By manipulating command-line arguments when collocations.py is invoked directly, an attacker can bypass validation and...

certgraveyard_yara v2026.09.02

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

sonar v0.4.1

root@kitploit: ██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a grou...

fence v0.1.67

Fence wraps commands in a sandbox that blocks network access by default and restricts filesystem operations based on configurable rules. It's most useful for running semi-trusted code package installs, build scripts, CI jobs, unfamiliar repos with controlled side effects, and it can also compleme...

skill-scanner v2.0.14

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines pattern-based detection YAML + YARA, LLM-as-a-judge , and behavioral dataflow analysis to maximize detection coverage of probable threats while...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

MAL-2026-15869 Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

[SECURITY] Fedora 43 Update: cockpit-367-1.fc43

The Cockpit Web Console enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more...

[SECURITY] Fedora 44 Update: valkey-9.0.6-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

codex-security npm-v0.1.25

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. 👉👉 See theCodex Security documentation for full documentation. Some cybersecurity requests and protected findings require approval through Trusted Access fo...

EUVD-2026-70785

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

EUVD-2026-70801

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

EUVD-2026-70814

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

EUVD-2026-70815

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

EUVD-2026-70768

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-70766

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

PT-2026-86223

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

PT-2026-85526

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a versio...