ObfuXtreme

If you find this GitHub repo useful, please consider giving it a star! ⭐ ⚡ ObfuXtreme — Advanced Python Obfuscation Engine ObfuXtreme is an advanced Python obfuscation engine focused on structural obfuscation , AST-level transformations , and runtime payload protection. It is designed for securit...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit To install the requirements execute: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Here is how to use the exploit: $ python primefaces.py -h...

Malicious code in libseal (PyPI)

Source: kam193 7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09 In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

Malicious code in iterquarry (PyPI)

Source: kam193 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

CVE-2026-106434

A flaw was found in MongoDB libmongocrypt. When processing an unrecognized encrypted payload during explicit decryption, the library returns the data unchanged instead of generating a decryption error. An attacker capable of modifying stored encrypted fields, such as a compromised database server...

CVE-2026-106434

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application...

Malicious code in pinochiomathm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e The package impersonates picomatch name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach. On...

Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-12176 Malicious code in dateuuidv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1 The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO at requi...

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

EUVD-2026-45040

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...

CVE-2026-55173

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...