CVE-2025-24659

CVE-2025-24659 1️⃣ Тип компонента Плагин WordPress 2️⃣ Детали компонента Название компонента Premium Packages – Sell Digital Products Securely Уязвимая версия Поскольку плагин Premium...

Pip-Intel

🌐PIP-INTEL - Outil d'OSINT et de Cyber Intelligence🌐 Testé sur : Kali-Linux Pip-Intel est un outil puissant conçu pour les activités d'OSINT Renseignement de sources ouvertes et de collecte de renseignements cybernétiques. Il consolide divers outils open-source en une seule interface conviviale,...

CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

EUVD-2026-91458

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104447

Versions of YesWiki before 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the autoupdate UpdateAction . The root cause is the use of unprotected GET requests , which allows an attacker to delete installed packages. By luring a logged-in administrator to a crafted...

AuraBorealisApp

AuraBorealis: Знаете ли вы, что содержится в ваших пакетах Python? О программе AuraBorealis — это веб-приложение для визуализации аномального и потенциально вредоносного кода в реестрах пакетов Python. Оно использует данные аудита безопасности, полученные при сканировании Python Package Index PyP...

Supply-Chain

Sécurité de la chaîne d'approvisionnement logicielle Une série complète de trois livres sur la sécurité de la chaîne d'approvisionnement logicielle, couvrant les menaces, les défenses et la gouvernance. Ce manuscrit open source fournit aux professionnels de la sécurité, aux développeurs et aux...

Debinject

Debinject Injecter du code malveillant dans les .debs MAINTENEURS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec DÉMO VIDÉO CLONAGE git clone https://github.com/UndeadSec/Debinject.git EXÉCUTION cd Debinject python debinject.py PRÉREQUIS python 2.x dpkg dpkg-deb metasploit AVERTISSEMENT...

aura

Ce dépôt a été déplacé vers un nouvel emplacement : https://github.com/SourceCode-AI/aura Audit de sécurité et introspection de code À propos du problème La tendance actuelle dans le développement est d'utiliser beaucoup de paquets en phase de développement, même s'ils n'offrent qu'une...

teamcity-cve-2026-63077-remediation

Enterprise Security Remediation Suite Производственный набор инструментов безопасности уровня enterprise, содержащий четыре специализированных пакета для реагирования на инциденты и усиления защиты. 📁 Архитектура модулей репозитория . ├── README.md Индекс корпоративного набора и краткое руководст...

CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC

🔓 CVE-2026-3502 - Эксплойт перехвата обновления TrueConf Client ⚠️ ПРЕДУПРЕЖДЕНИЕ Этот инструмент предназначен только для образовательных целей и авторизованного тестирования. Не используйте его в системах без явного разрешения. 📋 Описание Эксплойт для CVE-2026-3502 — уязвимость обновления без...

source-packages

source-packages Этот репозиторий хранит исходный код уязвимых программ для LinuxFlaw...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

EUVD-2026-90645

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103251

The software n8n versions before 1.123.80 , 2.39.6 , and 2.40.1 contains a validation bypass vulnerability in the community package installation handler specifically for queue mode deployments . An attacker with Redis write access can bypass name validation, permission checks, checksum verificati...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

Securiscan

Securiscan Securiscan Securiscan — это надёжный, лёгкий и нативный движок триажа безопасности на основе стандартной библиотеки, созданный для анализа уязвимостей в веб-приложениях, API, LLM и мобильных пакетах полностью с использованием встроенных средств Python. 🚀 Основные режимы работы 1...

CLEANSTART-2024-IK84393 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

CLEANSTART-2026-CR23307 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...