CLSA-2026-1790870094 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.0-tuxcare.1...

CLSA-2026-1790869390 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 8 @react-native-community packages to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

NPM: vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

NPM: vm2 allows a sandboxed plugin to execute native code through node:sqlite vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

Summary vm2 3.11.6 exposes Node.js's host node:sqlite module to NodeVM code when that builtin is allowed explicitly or through builtin: ''. The module is wrapped as read-only, but callable methods retain host-process authority. A sandboxed plugin can construct an in-memory database with extension...

vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

NPM: vm2 crypto builtin loads attacker native code through setEngine

NPM: vm2 crypto builtin loads attacker native code through setEngine vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

FUCKER

FUCKER Windows-native penetration testing framework written in Go. Modular architecture with AI-driven decision engine OpenAI-compatible API. Build go build -ldflags="-X main.version=$git describe --tags" -o FUCKER.exe ./cmd/fucker/ Cross-compile: GOOS=linux GOARCH=amd64 go build -o...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...

CLSA-2026-1790866461 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 2.0.2-tuxcare.1...

CVE-2024-25466

CVE-2024-25466 Description for CVE-2024-25466 Suggested description Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component. Vulnerability Type...

ROOT-APP-MAVEN-CVE-2026-45536 CVE-2026-45536 in io.netty:netty-transport-native-epoll - Patched by Root

Root has patched CVE-2026-45536 in the io.netty:netty-transport-native-epoll package for Root:Maven. Multiple fixed versions available...

CyberPup

CyberPup Una aplicación de ciberseguridad gratuita y de código abierto para personas comunes. CyberPup ayuda a usuarios no técnicos a proteger su vida digital mediante listas de verificación guiadas, lecciones breves y herramientas como la verificación de filtraciones. Toda la orientación se basa...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's...

PT-2026-104029

Name of the Vulnerable Software and Affected Versions SConnect affected versions not specified Description An unauthenticated remote code execution RCE issue exists in the SConnect native host component. The flaw results from a combination of memory management issues and cryptographic weaknesses...

CVE-2026-95331

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in the Almost Native Graphics Layer Engine ANGLE component may allow a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to visit a specially crafted web page, an attacker can...

CVE-2026-29145-Everything

CVE-2026-29145 Everything Apache Tomcat CLIENTCERT + OCSP soft-fail bypass complete reproduction environment, exploit traffic captures, and Suricata detection rule writing materials. For authorized security research and detection rule development only. Do not use on unauthorized systems...

CVE-2026-92938

A flaw was found in vm2. Untrusted code running within the sandbox environment can bypass isolation restrictions when the host SQLite module is accessible. By crafting module import requests and loading native database extensions, an attacker can escape the sandbox and achieve arbitrary code...

Malicious code in runhelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b30a78c30f51a72d8501b77d0cf6190319b8876ed7a119cc2f885adc3618212 On require'runhelper', index.js unconditionally loads a payload file staged by its dependency imgbundle at cdn-img-fetch/.runtime/rt.jpg, allocates...

Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

CVE-2026-102878

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...