Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

HackerOne: HackerOne Code sends live password-reset tokens to Segment in automatic page events

A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page...

bounty-targets-data — Updated!

bounty-targets-data What's it for This repo contains data dumps of Hackerone and Bugcrowd scopes i.e. the domains that are eligible for bug bounty reports. The files provided are: Main files: domains.txt: full list of domains, without wildcards. wildcards.txt: full list of wildcard domains. Note:...

Malicious Package

Overview test-npm-snurkeburk-hackerone is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159 The package's package.json declares a preinstall script that runs index.js automatically on npm install. index.js shells out via childprocess.exec to...

Malicious code in test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...

MAL-2026-14141 Malicious code in test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...

CVE-2026-68067

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

BountySkiller

BountySkiller — hacktivity & writeup collector Flask app that...

akto v2.14.7

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

bbscope — Updated!

bbscope.com Web interface and API for aggregating bug bounty program scopes from HackerOne, Bugcrowd, Intigriti, and YesWeHack. Quick start Docker root@kitploit: cd website cp .env.example .env Edit .env — at minimum set POSTGRESPASSWORD and your platform credentials docker compose up -d --build...

PYSEC-2026-2630 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

In mcp-server-git versions prior to 2026.1.14, the gitadd tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add, which did not enforce working-tree boundary checks for relative paths. As a result,...

Weblate command-line client susceptible to SSL verification skip

ImpactThe SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 WorkaroundsAvoid using untrusted wlc configurations, as that might cause insecure connections. ReferencesThis issue was reported to us by wh1zee via HackerOne...

PYSEC-2026-2051 Weblate command-line client susceptible to SSL verification skip

Impact The SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. References This issue was reported to us by wh1zee via HackerOne...

PYSEC-2026-2053 Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server. Patches https://github.com/WeblateOrg/wlc/pull/1128 Workarounds Do not use wlc download with untrusted servers. References This issue was reported to us by wh1zee via HackerOne...

PYSEC-2026-1621 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

In mcp-server-git versions prior to 2025.9.25, the gitinit tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, gitinit could operate on any directory accessible to the server proces...

PYSEC-2026-1623 mcp-server-git has missing path validation when using --repository flag

In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repopath arguments in subsequent tool calls were actually within that configured path. This could allow tool calls t...

PT-2026-55983

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the STARTTLS process. An attacker can compromise the security of the TLS connection by exploiting a scenario where a new transfer reuses an existing live connection despite a mismatch in TLS...