Exploit for CVE-2026-16723

Disclaimer: This project is intended only for secure researc...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12224 Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12272 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795 On require of index.js the package loads vendor.js, which selects a platform-specific payload linux/darwin/win32, downloads it over HTTPS from...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795 On require of index.js the package loads vendor.js, which selects a platform-specific payload linux/darwin/win32, downloads it over HTTPS from...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12274 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12236 Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

MAL-2026-12250 Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Exploit for Code Injection in Backupbliss Backup_Migration

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup M...

Exploit for SQL Injection in Wordpress

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup M...

MAL-2026-12165 Malicious code in bigops-external-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5 On require'bigops-external-auth', index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose...

Malicious code in bigops-external-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5 On require'bigops-external-auth', index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose...

bramble v1.14.1-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

augustus v0.14.15

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6020

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...