MAL-2026-17488 Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

MAL-2026-17483 Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...

Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

MAL-2026-17485 Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

MAL-2026-17481 Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

MAL-2026-17480 Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

MAL-2026-17484 Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

MAL-2026-17477 Malicious code in css-env-function-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e6fced50259d6d3781ef3917caba965e4744420188c3e06919541b64e2e294 Package self-describes as a CSS env shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings...

CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 est une vulnérabilité XSS réfléchie dans le gestionnaire de widget Bazar de YesWiki. Le paramètre de requête dans le point de terminaison NoSuchPage/widget est insuffisamment assaini à l'aide de striptags, qui n'échappe pas les guillemets doubles. Cela...

CVE-2026-58231

Script de détection CVE-2026-58231 Outil de détection et de vérification des conditions préalables pour CVE-2026-58231 — autorisation inappropriée dans le composant Data Hub Adapter de SAP Commerce Cloud CVSS 10.0. Le script effectue uniquement des vérifications non destructives. Il n'inclut ni...

CVE-2025-55182-EXP

CVE-2025-55182 취약점 악용 도구 도구 소개 본 도구는 CVE-2025-55182 취약점Next.js 관련 프레임워크의 코드 실행 취약점으로 추정을 탐지하고 악용하기 위한 도구입니다. 단일 대상/다중 대상 일괄 탐지, 명령 실행, 인터랙티브 셸 등의 기능을 지원하며, 다양한 시나리오에 맞는 4가지 공격 모드를 제공합니다. Base64 인코딩 명령, 프록시 전달, 로그 출력 등 유연한 구성을 지원합니다. 취약점 설명 CVE-2025-55182 취약점은 Next.js 관련 애플리케이션에 존재할 수 있으며, 악의적인 요청...

CVE-2025-14847

CVE-2025-14847 الوصف CVE-2025–14847، المعروف أيضًا باسم MongoBleed، هو ثغرة أمنية تسمح للمهاجمين بقراءة بيانات غير مصرح بها من مساحة ذاكرة الكومة heap للخادم الذي يعمل عليه قاعدة بيانات MongoDB، دون مصادقة. كيفية إعادة الإنتاج podman-compose vuln-machine/ up -d كيفية الاستغلال python3 -m venv ven...

Project-CVE-2026-45833

Projet-CVE-2026-45833 CVE-2026-45833 ChromaDB À UTILISER À VOS PROPRES RISQUES CERTAINES PARTIES DU CODE DOIVENT ÊTRE MODIFIÉES. 1. Générer un modèle malveillant python3 -c " from main import MaliciousModelGenerator gen = MaliciousModelGenerator gen.generatemodel'exfil-model', 'exfilenv',...

CVE-2026-9830

CVE-2026-9830 PoC d'évaluation de l'API BookingPress Pro Ce dépôt contient une preuve de concept en Python pour valider une exposition non authentifiée signalée de l'API REST BookingPress Pro. Une réponse positive peut contenir des informations de réservation et de client, y compris des données...

aws-vault

AWS Vault !WARNING This project has been abandoned and it's not receiving any more updates. If you want to continue to receive updates or contribute, please feel free to look at the active fork at: https://github.com/ByteNess/aws-vault AWS Vault is a tool to securely store and access AWS...

CVE-2024-0044

CVE-2024-0044 Aperçu CVE-2024-0044 est une vulnérabilité découverte dans certaines applications Android qui permet à des attaquants d'élever leurs privilèges en exploitant une faille dans la commande run-as. Cette vulnérabilité peut être exploitée en créant une charge utile spécifique qui accorde...