Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

ROOT-APP-MAVEN-CVE-2015-5211 CVE-2015-5211 in org.springframework:spring-core - Patched by Root

Root has patched CVE-2015-5211 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2018-1272 CVE-2018-1272 in org.springframework:spring-core - Patched by Root

Root has patched CVE-2018-1272 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41845 CVE-2026-41845 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41845 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

EUVD-2026-109601

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

ProcDump-for-Linux

ProcDump ProcDump is a Linux and Mac reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. ProcDump provides a convenient way for Linux and Mac developers to create core dumps of their application based on performance triggers. ProcDump for Linux and Mac is pa...

FML-Network

FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Paper: FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Dataset: FLNET2023 Introduction FLNET2023 is a state-of-the-art benchmark dataset for intrusion detection systems, specifically fo...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

coraza

Coraza - Web Application Firewall Coraza is an open source, enterprise-grade, high performance Web Application Firewall WAF ready to protect your beloved applications. It is written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set v4. Website:...

Malicious code in @capsense/core-ui (npm)

Source: ossf-package-analysis 8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d The OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

arduino-pico

Arduino-Pico Raspberry Pi Pico Arduino core, for all RP2040 and RP2350 boards This is a port of Arduino to the RP2040 Raspberry Pi Pico processor and RP2350 Raspberry Pi Pico 2 processor. It uses the bare Raspberry Pi Pico SDK and a custom GCC 16.1/Newlib 4.6 toolchain and supports ARM and RISC-V...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

log4j-patched

Log4J Patched Dependency for Log4Shell This repository aims to provide a patched version of the Log4J library for legacy system that can not be updated right away. The patch consist in a modified version of the log4j-core.x.x.x.jar file following the official recommandation of the Apache...

nmap-CVE-2023-35078-Exploit

nmap-CVE-2023-35078-Exploit Nmap script to exploit CVE-2023-35078 - Mobile Iron Core Save the script into a file named nmap-CVE-2023-35078-Exploit.nse. To run the script, you can use Nmap's --script-args option to provide the output file path: nmap -p --script nmap-CVE-2023-35078-Exploit.nse...

CVE-2021-44228

CVE-2021-44228 Apache Log4j Remote Code Execution） all log4j-core versions =2.0-beta9 and =2.14.1 The version of 1.x has other vulnerabilities, it is recommended to update to the latest version. Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: Download this project, compi...

fatal_core_dump

Fatal Core Dump Murder Mystery Repo for generating a core dump debugging murder mystery game site. THIS REPO HAS SPOILERS FOR THE GAME!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! You can play it here: https://www.robopenguins.com/fatalcoredump/ For a blog post on the design process see:...

wp2shell-lab

wp2shell-lab Educational PoC and lab for CVE-2026-63030 + CVE-2026-60137 : pre-authentication SQL injection in WordPress core via REST batch-route confusion. Discovered by Adam Kues Searchlight Cyber / Assetnote. Fixed in WordPress 6.9.5 / 7.0.2. Quick start bring up the vulnerable lab cd docker ...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...