massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

copy-as-yara

Copy as YARA Author: alden Copy disassembly nicely formatted for YARA rules. Description: This is a really simple plugin that allows you to copy disassembly in a way that can be used in YARA rules. You have the option to either copy the assembly code as it is or use address wildcarding to create...

jq-els-backport-cve-2025-48060

jq-els-backport-cve-2025-48060 Backported the upstream fix for CVE-2025-48060 heap buffer overflow in jvstringempty to jq 1.6. Backport CVE-2025-48060 – Backported upstream commit c6e0416 “Fix heap buffer overflow when formatting an empty string” from a newer jq version to jq-1.6, adapting intern...

CVE-2021-30809-OOM

CVE-2021-30809 — Apple WebKit Use-After-Free Vulnerability Crash PoC https://github.com/user-attachments/assets/e81f8a01-d48d-44cc-a38f-ce59b01222d5 Overview This repository contains a minimal crash-inducing harness for CVE-2021-30809, a use-after-free UAF vulnerability in WebKit. The PoC exercis...

CVE-2019-17427

CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. The vulnerability essentially exists on any wiki page which by default uses textile formatting. You can take advantage of it by using pre...

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Summary Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store...

GHSA-C8M5-C952-6CM4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Summary Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store...

EUVD-2026-110470

Datadog dd-trace-py: IAST instrumentation can lead to application DOS...

bst

Binary String Toolkit Summary The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for inclusions in source codes, such as those used to develop exploits and Proof of Concepts in the security field. Features Convert and dump...

PT-2026-125469

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

Fedora 46 : ags (2026-1664c569e1)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1664c569e1 advisory. Automatic update for ags-3.6.2.22-1.fc46. Changelog Mon Oct 26 2026 Dominik Mierzejewski - 3.6.2.22-1 - update to 3.6.2.22 resolves rhbz2558938 - backport...

Malicious Package

Overview formatting-subtitles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in formatting-subtitles (npm)

Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed by /bin/sh, which does not treat /... / as a comment...

MAL-2026-18184 Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

Malware in formatting-subtitles-for-claude

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in formatting-subtitles-for-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700 The package declares a postinstall hook sh./nodemodules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the...

MAL-2026-18099 Malicious code in formatting-subtitles-for-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700 The package declares a postinstall hook sh./nodemodules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the...

Malicious Package

Overview formatting-subtitles-for-claude is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

CVE-2026-112307

A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input containing embedded expressions, leading to arbitrary code...