MALW

CVE-2007-4559 - Polemarch exploit Full working exploit for Polemarch server https://www.polemarch.org/, using CVE-2007-4559, allowing: Injection of a cryptominer for monero using TOR for better hiding. Injection of a rootkit targeting most common sysadmin tools. POC Proof of concept using...

Rig-Exploit-for-CVE-2018-8174

Rig-Exploit-for-CVE-2018-8174 Rig Exploit for CVE-2018-8174 As with its previous campaigns, Rig’s Seamless campaign uses malvertising. In this case, the malvertisements have a hidden iframe that redirects victims to Rig’s landing page, which includes an exploit for CVE-2018-8174 and shellcode. Th...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Ledger Monero App Spend key Extraction PoC repository for article: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

Astra Linux – Vulnerability in Wireshark

The Monero protocol dissector in Wireshark versions 4.6.0 to 4.6.4, as well as 4.4.0 to 4.4.14, allows for denial of service attacks...

MAL-2026-15901 Malicious code in net-util-y8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7 The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The...

Malicious code in net-util-y8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7 The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner

A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre NCSC-NL has warned. The vulnerability in question is CVE-2026-65400 CVSS score: 9.8, a critical authentication issue...

Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.6.7: CVE-2026-5299: ICMPv6 dissector crash bsc1263757. CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5402: TLS dissector crash and possible code execution bsc1263755. CVE-2026-5403: SBC audio codec crash bsc126376...

ROS-20260714-73-0026

The vulnerability of the Monero protocol analyzer, a traffic analysis tool for computer networks developed by Wireshark, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a hacker to cause a service failure...

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 CVSS score: 9.3, an unauthenticated remote code execution RCE vulnerability in Langflow,...

CVE-2026-5409

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the Monero protocol dissector, leading to a crash of the application. This could result in a denial of service DoS for users analyzing network traffic. Mitigation To mitigate this issue, users can disable the Monero...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

rootpacket CVE-2026-31431 A Linux Docker-to-host cryptojack...

Monero: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution...

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer

We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold...

Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

MAL-2026-5529 Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

Monero: Background sync cache retains outgoing additional transaction secret keys

A vulnerability was identified in the Monero wallet background sync functionality. The vulnerability was found to retain additional transaction secret keys in the background cache, even after a scrub step intended to remove sensitive data. This could potentially expose transaction-related secret...

Monero protocol analyzer DoS

The vulnerability of the Monero protocol analyzer, a traffic analysis tool for computer networks developed by Wireshark, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a hacker to cause a service failure...

Monero: Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes

The /getaltblockshashes RPC endpoint was restricted to prevent unintended access to alternative block hashes. The endpoint had previously been unrestricted...