Exploit for CVE-2023-54391

CVE-2023-54391 – Proxmox VE Authentication Bypass TFA Bypass...

Exploit for CVE-2026-83531

CVE-2026-83531 — camel-dynamic-router: control-endpoint expres...

Astra Linux – vulnerability in Node.js

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerabili...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Use checkaddoverflow to prevent u16 DACL size overflow setposixaclentriesdacl and setntacldacl accumulate ACE sizes in u16 variables. When a file contains many POSIX ACL entries, the accumulated size may exceed 65535,...

Malware in zeroz-baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in aemath-baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in zero-baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in item-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in items-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in prastzyy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in prastzy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in xzbails

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Security Control Bypass

github.com/0xjacky/nginx-ui is vulnerable to security control bypass. The vulnerability is due to the MCP tool nginxconfigadd failing to validate configuration files before writing them to disk and reloading Nginx, which allows an authenticated attacker to bypass security restrictions by injectin...

Malicious code in @apexacc/audit (npm)

@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign Elastic Security Labs REF8801, 2026-10-12. It exposes an MCP server with 18 "security tools" that all return fabricated output for example a fixed Slither report and a "NOT A HONEYPOT" verdict, registers...

Improper Access Control

github.com/0xJacky/Nginx-UI is vulnerable to improper access control. The vulnerability is due to improper validation of restricted Nginx directives in the MCP configuration interface, which allows an authenticated attacker to inject malicious configuration, load attacker-controlled JavaScript, a...

Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

Malware in @fluxionii/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2026-117378

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...

PT-2026-117387

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

PT-2026-117622

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.7 Craft CMS versions 5.0.0 through 5.10.9 Description A Twig sandbox allowlist bypass exists because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys vi...