PT-2026-84532

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A Server-Side Request Forgery SSRF issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the...

Alibaba Cloud Linux 3 : 0280: dracut (ALINUX3-SA-2026:0280)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0280 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-15816: A flaw was found in dracut. The die...

SUSE CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

MAL-2026-15625 Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

sogen — Updated!

Sogen runs Windows and Linux programs without a real operating system, and lets you see and control everything they do. Instead of reimplementing thousands of OS APIs, Sogen emulates binaries at CPU and syscall level and runs the real system DLLs , so behavior closely matches the real OS. Every...

CVE-2026-60004-Gitea-RCE-PoC

🫖 CVE-2026-60004 — Gitea RCE PoC A direct, single-target validation tool for Gitea's diffpatch Git-hook remote code execution vulnerability. This repository contains the focused AfterDark validator: one script, one target, one run. There are no discovery, reconnaissance, verification, or other...

CVE-2026-60004-Gitea-Validator

🫖 CVE-2026-60004 Gitea Validator A standalone discovery, assessment, and contract-correlated validation tool for the Gitea diffpatch Git-hook remote code execution vulnerability. scanner.py gives penetration testers, defenders, and security researchers one dependency-free tool for: 🔎 Passive Gite...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

RHEL 8 : dracut (RHSA-2026:61252)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61252 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

Exploit for Code Injection in Gitea

🫖 CVE-2026-60004 — Gitea RCE PoC A direct, single-target va...

Exploit for Code Injection in Gitea

🫖 CVE-2026-60004 Gitea Validator A standalone discovery, as...

CVE-2026-82649

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

OESA-2026-3500 dracut security update

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...

CVE-2026-82649: Uncontrolled Search Path Element

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

MAL-2026-15561 Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...