480 matches found
CVE-2026-115779
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
EUVD-2026-116496
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2026-115779
The Effect TypeScript framework is vulnerable to cookie attribute injection in the @effect/platform package. Specifically, versions 0.1.0 through 0.97.1 (and effect versions 4.0.0-beta.0 through 4.0.0-beta.103 ) fail to sanitize semicolon delimiters in the name, domain, and path fields passed to ...
CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2026-115779: Effect-TS, @effect: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript…
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2018-17463
CVE-2018-17463 Working Proof of Concept Exploit for CVE-2018-17463 utilzing WebAssembly RWX Pages for Shellcode execution. CVE-2018-17463 stemmed from the incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64, allowing a remote attacker to execute arbitrary code inside a...
CVE-2026-40176
CVE-2026-40176 — Composer Perforce Driver Command Injection Proof of Concept A self-contained, OOP-style PHP proof of concept that demonstrates and differentially verifies a command-injection vulnerability in Composer's Perforce repository driver. The PoC runs the same malicious composer.json...
Malware in tailwindcss-effect-lab
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Cross-Interface Authorization for AI Computer-Use Agents
Computer-use agents act through graphical interfaces, command lines, APIs, scripts, and Model Context Protocol servers. A policy decision can be interface-invariant while its executable authorization is not: another route can bypass mediation, alter a security-relevant default, or commit after th...
Where You Inject Matters: The Trust Region Effect in LLM Agents
LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their growing capabilities, these agents remain vulnerable to real-world attacks such as indirect prompt injections, which manipulate agents through malicious instructions embedded i...
Back to Basics: Formal Analysis Hints Improve Weak-To-Strong Monitoring
Frontier agentic systems are capable of taking misaligned actions that may cause significant harm. Monitoring techniques are developed to oversee these systems in order to detect and prevent dangerous actions. However, current state-of-the-art monitors suffer from four persistent failure modes:...
ulysses-harness
Ulysses: A Graph-Based Harness for Verifiable Web Exploitation...
Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems
Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and...
Malicious code in tailwindcss-effect-lab (npm)
tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...
Malicious Package
Overview tailwindcss-effect-lab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Malicious code in tailwindcss-effect-lab (npm)
tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...
MAL-2026-18087 Malicious code in tailwindcss-effect-lab (npm)
tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...
Exploit for CVE-2026-103849
CVE-2026-103849 / BlockStrap validation lab !Static validat...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Input: iforce processes the force-feedback effect index directly from the device. The iforceprocesspacket function handles a status report packet ID 0x02 by retrieving the force-feedback effect index from the device and using it ...