21554 matches found
Malicious code in @crbrc/xbt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...
Malicious code in text-line-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...
MAL-2026-11151 Malicious code in text-line-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...
CVE-2026-57217
A flaw was found in RabbitMQ, a messaging and streaming broker. During metadata-store failures, the topic authorization mechanism can incorrectly allow restricted topic writes and binds. This occurs because permission lookup errors from Khepri are treated as an 'allow' condition by the internal...
CVE-2026-15025
The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...
aws-ecs-container-agent-tasks Detection
Aws container metadata content !/usr/bin/env python3 -- coding: utf-8 -- """Aws container metadata content.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'aws-ecs-container-agent-tasks Detection', 'description': 'Aw...
NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure Detection
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getitem function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data includi...
Well-Known OAuth Authorization Server Metadata Detection
Detects OAuth 2.0 Authorization Server metadata RFC 8414. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OAuth 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Well-Known OAuth Authorization Server Metadata...
NPM package.json Disclosure Detection
All NodeJS packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project generated by package managers such as npm, yarn, pnpm. !/usr/bin/env python3 -- coding: utf-8 -- """All NodeJS packages contain a file, usually in the...
SAP NetWeaver CVE-2025-31324 Detection
Detects unauthenticated access to SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 without uploading a malicious payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer CVE-2025-31324 unauth metadata uploader detection.""" from kittysploit import from...
CVE-2026-58404
A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...
CVE-2026-51275
...
CVE-2026-51252
...
CVE-2026-51252
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Multiples vulnerabilities in jsPDF
Brocade SANnav provides security updates for multiple CVEs affecting jsPDF. CVE-2025-68428 sPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given...
CVE-2026-67173: Server-Side Request Forgery (SSRF)
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
PT-2026-65489
schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata...
PT-2026-65538
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertoken request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
