...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

MAL-2026-13695 Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

metabigor v2.2.0

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

fwupd:uswid_fuzzer: Crash in g_byte_array_append

Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=5430594256044032 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: uswidfuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7a619a501520 Crash State:...

vlc:vlc-demux-dec-libfuzzer-ps: Heap-buffer-overflow in Reassemble

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=4888372232650752 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-ps Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x797256de0400...

Exploit for CVE-2026-64638

🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit Behav...

Exploit for CVE-2026-64638

🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638...

mruby:mruby_fuzzer: Heap-buffer-overflow in mrb_vm_exec

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5893394698928128 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x7afb1cae0480 Crash State:...

SkillSpector v2.8.2

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

Setup IPsec VPN — Updated!

English | 简体中文 | 繁體中文 | 日本語 | Русский IPsec VPN Server Auto Setup Scripts Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. An IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5482017228390400 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

Exploit for CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/s...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

MAL-2026-13632 Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

MAL-2026-13658 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Unbreakable Enterprise kernel security update

6.12.0-205.92.4.2 - net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp Dongli Zhang Orabug: 39844842 - x86/bugs: Make Safe-RET robust against interrupt injection Borislav Petkov AMD Orabug: 39844812 CVE-2026-68480 - KVM: x86: Check for invalid/obsolete root after making MMU...

asterisk v23.5.0-rc1

The AsteriskR Open Source PBX root@kitploit: By Mark Spencer and the Asterisk.org developer community. Copyright C 2001-2025 Sangoma Technologies Corporation and other copyright holders. SECURITY It is imperative that you read and fully understand the contents of the security information document...