magento2-cosmic-sting-patch

Magento 2 Patch for CVE-2024-34102aka Cosmic Sting An alternative solutionas a Magento 2 extension to fix the XXE vulnerability CVE-2024-34102aka Cosmic Sting. If you cannot upgrade Magento or cannot apply the official patch, try this one. If you don't fix this vulnerability, the attacker can RCE...

virustotalx

virustotalx per gli endpoint virustotalx per gli IP V2 Installazione root@kitploit: git clone https://github.com/orwagodfather/virustotalx.git root@kitploit: cd virustotalx crea 3 account https://www.virustotal.com/gui/join-us e copia le 3 chiavi API === root@kitploit: nano orwa.sh & root@kitploi...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH Rotazione Chiavi 5G Core & Auditor Ghost Admin v1.1 © 2026 CYBERDUDEBIVASH – Tutti i diritti riservati Autorità Globale nella Sicurezza 5G Zero-Trust e Reti Private Bhubaneswar, Odisha, India Strumento di livello produttivo per rilevare e correggere CVE-2026-0622 privilege...

MAL-2026-14544 Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

Malicious code in desmoshomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae975f53feac57fc6aec90279e55e994d6e61d177217b012dfb59c6f42a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ilovedesmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efb46da64ab0f3eaee41abecec08214a4af0f228c701fd39ad711c0ae124927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosclasswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d435d8cefda2b58ca65ad06ffac8521a26ccb991dd4828dd479e64ddb38bb865 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14413 Malicious code in livemcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80caa46e4bb231b0640c11ecb691ccf936f316205010487c57178eaf2100e8f7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mcp-real-chrome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 952bd642bd2f2aee3fd768385ee5d8dd3d5b387c7a9171e8ddcb8983f3499d2d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14352 Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bcnfjndwbkf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1fc1ec45930a69372eadc47b662c5d82b247b5b4227feacda3d1c4302b4bf3 The package contains only index.html and declares main: 'index.html' with no scripts, no bin, and no JavaScript library surface. The HTML mimics a...

CVE-2026-17578

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

EUVD-2026-53299

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578

Kong Event Gateway vulnerable components: versions 1.0.0–1.1.1 and 1.2.0 fail to enforce key rotation before reaching the NIST SP 800-38D usage limit for AES-GCM keys when AWS IAM encryption is enabled. Under sustained high message rates that trigger a reboot without rotation, nonce collisions be...

Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key.Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

PYSEC-2026-1377 Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

EUVD-2026-37817

Steeltoe's static JWKS cache shared across schemes and never invalidated...

Exposure of Resource to Wrong Sphere

Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the TokenKeyResolver function. An attacker can bypass authentication and gain unauthorized access by exploiting the shared static JWKS cache across multiple schemes, allowing a key fetched for one...