CVE-2026-13836

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514420555...

CVE-2026-13837

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514429130...

CVE-2026-14004

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514538751...

CVE-2026-14085

A side-channel information leakage flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513155863...

CVE-2026-14098

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513375767...

Bulma CSS Framework - Detect

Detects the presence of the Bulma CSS Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Bulma CSS Framework.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bulma CSS...

WordPress Simple Custom CSS Plugin - Full Path Disclosure Detection

Detected WordPress Simple Custom CSS plugin internal file system path was exposed through direct file access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Simple Custom CSS plugin internal file system path was exposed through direct file access.""" from kittysploit import from...

Verba (The Golden RAGtriever) Panel - Detect

Verba, also known as "The Golden RAGtriever", an open-source retrieval-augmented generation RAG chat application built by Weaviate that ships a Next.js frontend backed by a FastAPI/uvicorn server and is commonly deployed on port 8000, was detected via a unique compiled CSS class name present in t...

Materialize CSS - Detect

Detected the presence of Materialize, a modern responsive front-end framework based on Material Design. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of Materialize, a modern responsive front-end framework based on Material Design.""" import re from kittysploit import from...

mTheme Unus < 2.3 - Directory Traversal Detection

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. !/usr/bin/env python3 -- coding: utf-8 -- """The mTheme-Unus theme for...

CVE-2026-59895

A flaw was found in Hono, a web application framework. The cx function within hono/css improperly handles class names during server-side rendering. This allows an attacker to inject untrusted values into a JSX class attribute, leading to the injection of arbitrary markup. This could result in...

Malicious Package

Overview motion-forge-css is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in motion-forge-css

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-11101 Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...

Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...

Malicious code in vite-plugin-css-blend (npm)

Source: amazon-inspector 7a47fa75fbd028d1aca89ca790036f760c76d8e486175505ef4a8f59f33e7c76 The package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented applyGlobalStylespalette, accents export, when called on Windows, treats the caller-supplied accents and palette...

Malicious Package

Overview devplatform-vite-plugin-preserve-css-modules is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in swiper-css-normalize (npm)

--- Credit: OpenSSF source...

Malicious code in animated-css-kit (npm)

Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers src/side-effects.js, which is heavily obfuscated obfuscator.io...

Malicious Package

Overview hermes-apex-css-minimizer-webpack-plugin-phoebe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...