CVE-2026-94486

The Next.js React framework (versions 16.0.0 through 16.3.8 ) contains an information disclosure vulnerability in the next dev development server . The server exposes a Model Context Protocol endpoint that fails to reliably restrict cross-site requests. This allows a malicious website visited by ...

flipper-mcp

flipper-mcp 一个 Rust MCP（模型上下文协议）服务器，直接运行在 Flipper Zero 的 WiFi Dev Board v1（ESP32-S2）上，使 AI 代理能够通过网络控制 Flipper Zero。 这是什么？ 这个项目将 MCP 服务器放在 Flipper 本身上 。任何兼容 MCP 的 AI 客户端（Claude Desktop、Claude Code 等）都可以连接，并将 Flipper 的功能作为工具使用——SubGHz、NFC、RFID、IR、GPIO、BadUSB、iButton、文件存储等。 与其他需要 USB...

Malicious Package

Overview @smart-dev-wa/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview brioche-apl-dev-env is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

a2sv

1. A2SV? Auto Scanning to SSL Vulnerability. HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc A. Support Vulnerability - CVE-2007-1858 Anonymous Cipher - CVE-2012-4929 CRIMESPDY - CVE-2014-0160 CCS Injection - CVE-2014-0224 HeartBleed - CVE-2014-3566 SSLv3 POODLE - CVE-2015-0204 FREAK Attack...

Linux Distros Unpatched Vulnerability : CVE-2026-94485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

Linux Distros Unpatched Vulnerability : CVE-2026-94486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE（未授权） PHP 8.1.0-dev WebShell RCE（未授权）的 Exploit 代码 预期结果：利用安装在 PHP 8.1.0-dev 服务器上的后门，从而获得 WebShell 以远程执行命令。 仅用于企业环境中的教育和测试目的。 此 Exploit 已在 Python 3.8.6 上测试通过 使用方法： cfx: /Documents/ → ./exploit.py -h usage: exploit.py -h -l URL PHP 8.1.0-dev WebShell RCE by ColdFusionX...

CLSA-2026-1790884229 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.0-tuxcare.4...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket 任意文件读取批量检测 免责声明： 本工具仅用于授权的安全测试和教育研究。使用者应遵守当地法律法规，未经授权扫描或攻击他人系统属于违法行为。作者不对任何滥用行为承担责任。 漏洞描述 Vite 开发服务器（6.0.0 6.4.1, 7.0.0 7.3.1, 8.0.0 8.0.4）的 HMR WebSocket 未校验 Origin 头，攻击者可通过 vite:invoke 事件调用 fetchModule，使用 file:// 协议配合 ?raw 参数绕过 server.fs.allow...

CLSA-2026-1790876768 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 8.1.1-tuxcare.1...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server 任意文件读取 PoC 针对 GHSA-p9ff-h696-f583 的可直接运行 PoC。通过未鉴权的 HMR WebSocket 调用 fetchModule，绕过 HTTP 层的 server.fs.allow 限制，读取 dev server 所在机器上的任意文件。 影响范围 版本线| 受影响| 已修复 ---|---|--- Vite 6| =6.0.0, =7.0.0, =8.0.0, → 403）。 2. 但 HMR WebSocket 的握手只校验： Sec-WebSocket-Protocol:...

php-8.1.0-dev-backdoor-rce

PHP 8.1.0-dev 后门远程代码执行 PHP 8.1.0-dev 后门系统 Shell 脚本 PHP 8.1.0-dev 版本于 2021 年 3 月 28 日发布时内置了一个后门，但该后门很快被发现并移除。如果服务器运行此版本的 PHP，攻击者可通过发送 User-Agentt 头来执行任意代码。 问题被发现后，原始代码已被恢复，但随后又遭到第二次篡改。该入侵会在任何运行了被篡改版本 PHP 的网站上创建后门，使黑客能够在站点上执行远程代码。 阅读完整文章：https://flast101.github.io/php-8.1.0-dev-backdoor-rce/ POC 脚本...

PHP-8.1.0-dev-Backdoor

PHP 8.1.0-dev User-Agentt 后门远程代码执行（RCE） 严重性： 严重（CVSS 等效值：10.0） 漏洞类型： 供应链后门 / 远程代码执行（RCE） 受影响软件： PHP 8.1.0-dev（仅限开发构建版本） 攻击向量： 远程（未认证） 是否需要认证： 否 用户交互： 无 影响： 系统完全沦陷 概述 PHP 8.1.0-dev User-Agentt 后门 是开源软件历史上最臭名昭著的供应链入侵事件之一。与源于编程错误的传统漏洞不同，此问题源于恶意代码被故意插入 PHP 官方源代码仓库 。 该后门出现在 2021 年 3 月 期间的 PHP 8.1.0-de...

CLSA-2026-1790866099 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.4-tuxcare.2...

CLSA-2026-1790866070 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 6.1.3-tuxcare.1...

CVE-2024-3829

CVE-2024-3829 for Qdrant - 漏洞利用 这是针对 QDRANT 1.9.0-dev 的 CVE-2024-3829 漏洞利用程序 | || | | || | | || || || | | | | | | | | || | | || || || | | || | | || || || | | | | || | | || | | | | || || | || | || | | | | || ||| | || | | || || | | || || | | || || || || | | || | | || || | | | | | | | | | | || | | |...

CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...

CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...