MAL-2026-11124 Malicious code in api-node-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a On npm install, the package's postinstall hook node test.js executes an attacker-controlled workflow against the installer's host. It recursively sca...

CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

EUVD-2026-49845

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922

Pivotick CVE-2026-66922 affects the tree-layout and cycle-detection code by using plain JavaScript objects as lookup tables indexed with node identifiers that can collide with Object.prototype properties (e.g., constructor, toString, proto ). This can cause inherited-property confusion, wrong typ...

CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

OffsetInspect v3.3.0

OffsetInspect A bounded-memory PowerShell toolkit for byte-offset inspection, source correlation, binary comparison, and defensive detection-boundary analysis. OffsetInspect answers a practical analyst question: What content is present at this byte offset, and what source or binary context...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

EUVD-2026-49768

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

Kube API Secrets Detection

Scans for kube secrets endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Scans for kube secrets endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikekubernetessecretlist, validatejsonprobe class ModuleScanne...

Form Detection

A template to detect HTML Forms in page response. !/usr/bin/env python3 -- coding: utf-8 -- """A template to detect HTML Forms in page response.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Form Detection',...

Apache NiFi detect

Detects Apache NiFi detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache NiFi detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache NiFi detect', 'description': 'Detects Apache NiFi...

OpenReplay RUM - Tech Detect

Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Operations Automation Default Page Detection

Detects Operations Automation Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Operations Automation Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Operations Automation Default Page...

Oracle ATG Commerce Panel - Detect

Oracle ATG Commerce panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle ATG Commerce panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle ATG Commerce Panel - Detect',...

Oracle Fusion Middleware - Detect

Oracle Fusion Middleware was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Fusion Middleware was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Fusion Middleware - Detect',...

Etcd Version - Detect

Template detects Etcd version. !/usr/bin/env python3 -- coding: utf-8 -- """Template detects Etcd version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Etcd Version - Detect', 'description': 'Template detects Etcd...

Event Debug Server Status Detection

Exposes server status,logs and internal information. !/usr/bin/env python3 -- coding: utf-8 -- """Exposes server status,logs and internal information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Event Debug Serve...