MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

CVE-2024-2876

CVE-2024-2876 - Уязвимость SQL-инъекции в Email Subscribers от Icegram Express Обзор CVE-2024-2876 — это критическая уязвимость безопасности, обнаруженная в плагине "Email Subscribers by Icegram Express" для WordPress. Эта уязвимость затрагивает версии до 5.7.14 включительно и представляет...

owasp-ctf-in-a-box

OWASP CTF in a Box A self-hosted control plane for security-learning events — one box, one free GitHub org. Run it for a university, a high school, an OWASP chapter, a meetup. Working on the kit humans and agents Read AGENTS.md before you write code. It is the operating manual: the exact commands...

CVE-2024-41713-PoC-exploit

CVE-2024-41713-PoC-exploit Contournement d'authentification Mitel MiCollab menant à une lecture arbitraire de fichiers ❯ ./cve-2024-41713-exploit.sh Exploitation de CVE-2024-41713 pour lire /etc/passwd ... + Utilisateurs extraits de /etc/passwd : root bin daemon adm lp mail operator games ftp...

apache__rocketmq_CVE-2023-33246_5-1-0

Apache RocketMQ !Build Statusmaven-build-imagemaven-build-url !CodeCovcodecov-imagecodecov-url !Maven Centralmaven-central-imagemaven-central-url !Releaserelease-imagerelease-url !Licenselicense-imagelicense-url !Average Time to Resolve An...

Security Bulletin: Vulnerabilities reported in netty-codec-4.1.135.Final.jar for APIM

Summary Vulnerabilities found in netty-codec-4.1.135.Final.jar are addressd in APIM 11.1 Vulnerability Details CVEID:CVE-2026-56745 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final...

paracosme

Paracosme - CVE-2022-33318 - удаленное выполнение кода в ICONICS Genesis64 Paracosme — это эксплойт повреждения памяти, который я написал для атаки на пакет Genesis64 версии 10.97.1, созданный компанией ICONICS, для достижения удаленного выполнения кода. Эксплойт был продемонстрирован в рамках...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

jboss-autopwn-1

jboss-autopwn JBoss Autopwn tel que présenté à BlackHat Europe 2010 - cette version intègre CVE-2010-0738, la vulnérabilité de contournement d'authentification JBoss par manipulation du verbe HTTP, découverte par Minded Security C. Papathanasiou 2010 INTRODUCTION Ce script JBoss déploie un shell...

authproof-sdk

AuthProof SDK AuthProof est un protocole de délégation cryptographique pour l'IA agentique. La plupart des protocoles dans ce domaine appliquent une politique définie par l'opérateur — donnant à l'opérateur l'autorité d'élargir ou de réinterpréter l'intention originale de l'utilisateur après coup...

lockjaw

Lockjaw - 고급 Windows C2 프레임워크 v0.2.15 Lockjaw는 레드팀 교전, 적대적 시뮬레이션, 스텔스 작전을 위해 설계된 고급 모듈식 명령 및 제어C2 프레임워크입니다. 이는 현대적인 분할 언어 아키텍처를 사용합니다: 고동시성 Rust 팀서버와 회피형이며 의존성이 없는 Zig 임플란트, 그리고 순수 어셈블리 위치 독립 코드PIC 스테이저로 구성됩니다. 이것은 알파 소프트웨어입니다 사용에 따른 책임은 본인에게 있습니다. 모든 기능이 테스트되지 않았으며, 코드는 검토되지 않았습니다. 버그가 존재하고 특정 명...

fixing-google-secops-detections

Google SecOps Chronicle Curated Detections: Flaw Analysis & Tuning This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps Chronicle Curated Detections. While Google Threat Intelligence GTIG provides exceptional conceptual threat...

aqua-checksums

aqua-checksums Внешний мониторинг целостности цепочки поставок для проектов с открытым исходным кодом Aqua Security. Что делает этот репозиторий Этот репозиторий непрерывно отслеживает целостность опубликованных артефактов Aqua Security — контейнерных образов, релизов GitHub, Git-тегов и файлов...

DutchOven

DutchOven Application-scoped Windows network brownouts for deterministic red-team validation. Native C • Windows Filtering Platform • IPv4 + IPv6 • Dynamic cleanup Read the accompanying blog post → Quick start • Profiles • CLI • How it works • Build • BOF • Validation !CAUTION Controlled...

NoiseHound

NoiseHound Detection-aware Active Directory attack-path scoring. DreadHost Research | companion to OffsetInspect PowerShell and OffsetScan Rust BloodHound and PlumHound on top of it finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost...

SrHollow

SrHollow Извлечение секретов LSA, повторное использование существующей теневой копии VSS + встроенный парсер regf + расшифровка LSA AES-256 через bcrypt.dll. Цепочка из 6 шагов 1. Перечислить\GLOBAL?? через NtOpenDirectoryObject + NtQueryDirectoryObject. Выбрать HarddiskVolumeShadowCopyN с...

redteam-ai-benchmark

Red Team AI Benchmark Version russe : README.ru.md Red Team AI Benchmark est un benchmark d'évaluation de modèles en ligne de commande CLI. Il mesure comment les LLM comprennent et répondent aux questions et scénarios de red team ; ce n'est pas un outil pour mener ces activités. La version 2...

openSUSE 16 Security Update : pcapplusplus (openSUSE-SU-2026:22017-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22017-1 advisory. Changes in pcapplusplus: - Update to version 26.07 libpcap / WinPcap / Npcap is now optional. Bumped the minimum required C++ standard to C++14...

Decepticon v1.2.2

Decepticon — Autonomous Red Team Agent "Another AI hacker? Let us guess — it runs nmap and writes a report." ☁️ Don't want to self-host? Decepticon is live in the cloud. Skip the Docker setup — run autonomous red-team engagements right from your browser. Install Prerequisites : Docker and Docker...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: kafbat-ui, dependency-track, s3proxy, kayenta, knative-kafka-broker-fips, cassandra-fips, opensearch, hadoop-client-modules, spark, apache-hop, zaproxy, ontop-fips, floci-az, elasticsearch-fips, opensearch-fips, spark-fips, trino, nacos-docker, apicurio-registry-fips...