sloppy-joe

Catch hallucinated, typosquatted, and non-canonical dependencies before they reach production. cargo install sloppy-joe TheLiteLLM supply chain attack March 2026 compromised a package with 97M monthly downloads. Attackers stole publishing credentials, pushed malicious versions that harvested SSH...

safer-dependencies

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

staystaystay

staystaystay staystaystay is a proof of concept exploit for CVE-2021-1585, a man in the middle or evil endpoint RCE issue affecting Cisco ASA Device Manager ASDM. The issue was originally discovered by Malcolm Lashley and disclosed in the summer of 2021. However, at the time I was looking at this...

heimdall_webserver

ATTENTION, this project is on a beta version, there's a lot of bugs and problem, if you want to help the project use this on a lab not in yout real environment. NO, there's not https implemented yet, it will come on the next upgrade Heimdall It's a tool to manage vulnerables packages in your nix...

platform_packages_providers_MediaProvider_CVE-2023-40127

This repository does not have a README...

Packages_app_settings_CVE-2020-0201

This repository does not have a README...

ROOT-OS-DEBIAN-12-CVE-2025-71088 CVE-2025-71088 in linux - Patched by Root

Root has patched CVE-2025-71088 in the linux package for Root:Debian:12. Multiple fixed versions available...

debian-lenny-bash_3.2.52-cve-2014-6271

debian-lenny-bash3.2.52-cve-2014-6271 Debian Lenny Bash packages with cve-2014-6271 patches i386 and amd64 You can test the flaw by running: env x=' :;; echo vulnerable' bash -c "echo this is a test"...

CLEANSTART-2026-UM98418 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

scavenger_scanner

CVE-2025-54313 IOC Scanner Cross-platform scanners for detecting Indicators of Compromise IOCs related to the eslint-config-prettier supply chain attack CVE-2025-54313. On July 18, 2025, several popular npm packages were compromised through a phishing attack. The attacker gained access to the...

CVE-2026-110664

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-102786

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-110664

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 7.2.8 . The flaw exists in the 'note' parameter due to insufficient input sanitization and output escaping. Attackers with subscriber-level...

CVE-2026-110664 Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

AuraBorealisApp

AuraBorealis: Do You Know What's In Your Python Packages? About AuraBorealis is a web application for visualizing anomalous and potentially malicious code in Python package registries. It uses security audit data produced by scanning the Python Package Index PyPI via Aura, a static analysis...

Debinject

Debinject Inject malicious code into .debs MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec VIDEO DEMO CLONE git clone https://github.com/UndeadSec/Debinject.git RUNNING cd Debinject python debinject.py PREREQUISITES python 2.x dpkg dpkg-deb metasploit DISCLAIMER TO BE USED FO...

aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

CLEANSTART-2026-JD75855 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

PT-2026-115895

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115907

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...