Mangle

此存储库已归档 要查看最新版本的 Mangle 或提交问题，请参考 https://github.com/Tylous/Mangle。 Mangle 作者：Tyl0us 在 Source Zero Con 2022 上展示 Mangle 是一款用于操作已编译可执行文件（.exe 或 DLL）的工具。它可以移除基于已知入侵指标（IoC）的字符串并用随机字符替换，通过增加文件大小来规避 EDR 检测，以及从合法文件中克隆代码签名证书。通过这种方式，Mangle 帮助加载器规避磁盘和内存扫描器。 贡献 Mangle 使用 Golang 开发。 安装 首先，克隆仓库。在编译 Mangle...

The Hidden DoS Vector in SQL Parsers

SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two...

Backdoor in the Loop: Compromising Agentic Search Via Malicious Retrievers

Agentic retrieval-augmented generation RAG interleaves reasoning with repeated retrieval, giving the retriever influence over both the evidence an agent observes and its subsequent search decisions. We study retriever backdoors that exploit this feedback loop and repurpose weak backdoor...

FragToken: Amplifying LLM Inference Costs through Noncanonical Token Generation

As large language model LLM inference becomes increasingly expensive, resource-consumption attacks pose a growing threat to model providers. Existing attacks typically amplify cost by inducing abnormally long or repetitive outputs on attacker-controlled or triggered requests, making them easier t...

CVE-2026-63627

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...

GHSA-5GMM-HJFJ-8FF7 Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Summary The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the doUpgrade process. An attacker can inflate their credit balance by sending multiple concurrent downgrade requests, resulting in multiple refunds for a single legitimate downgrade. Remediation Upgrade...

Malicious code in jaja-kepok64-sukiwir (npm)

Source: amazon-inspector 84820059a60fbc0e6e6cc201c9a0a802829b64a4be68b44e563c8f3f85e41820 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hanafi-rangi46-miaww (npm)

Source: amazon-inspector f9e8b40d9cfe0346c9fb876037762a5dc9465dfaff99ac99630291402e6e3640 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-90544

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting...

CVE-2026-90544

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers with low privileges can increment view counts and watch-time on videos they cannot acc...

EUVD-2026-76862

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting...

DEBIAN-CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

PT-2026-90423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the nfsd cross mnt function when follow down returns a negative value. The function initializes a local path structure using mntget and dget, but fails to call...

CVE-2026-19436 Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

CVE-2026-19436

The Ultimate Gift Cards for WooCommerce WordPress plugin (versions before 3.2.10 ) contains a vulnerability where it fails to reconcile the issued gift card coupon value against the actual amount collected at checkout. This flaw allows unauthenticated users to perform a Gift Card Value Inflation ...

WordPress Ultimate Gift Cards for WooCommerce plugin < 3.2.10 - Unauthenticated Gift Card Value Inflation vulnerability

Unauthenticated Gift Card Value Inflation vulnerability discovered by Guillermo Álvarez Fernández in WordPress Plugin Ultimate Gift Cards For WooCommerce versions 3.2.10...

SUSE CVE-2026-55763

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-86840

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

EUVD-2026-72876

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...