6556 matches found
MAL-2026-825 Malicious code in devtools-webhook-cicd-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 807557cb6ac51aece00eeb28f55b89815176c95172780dcdded46b667f843771 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and...
OpenSSH 10.2p1 Authorized Keys Persistence Tool
This Metasploit Auxiliary module establishes persistent access to remote systems by adding an SSH public key to a target user's authorizedkeys file after successful authentication. The module requires valid SSH credentials password or private key and supports both Unix-like and Windows SSH...
Fortinet Fortigate SSL-VPN Symlink Persistence Patch Bypass (FG-IR-25-934)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-25-934 advisory. - An Exposure of Sensitive Information to an Unauthorized Actor vulnerability CWE-200 vulnerability in Fortinet FortiOS 7.6.0...
MAL-2026-811 Malicious code in grokwrapper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...
Malicious code in grokwrapper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...
Exploit for Improper Initialization in Linux Linux_Kernel
markdown Chrono-Drip: Temporal Viscosity Exploitation Frame...
MAL-2026-796 Malicious code in @rdxportal/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6715dad49a0781dc55e72ae77bd13276de1564d08cfd1c0a3c3aebf37b72acc The package @rdxportal/ui-components was found to contain malicious code. Source: ghsa-malware...
MAL-2026-789 Malicious code in syf-typings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb43a4c463e5215767c2b81094bce1ced474c522ed212471d7ac62ff11d01a4 The package syf-typings was found to contain malicious code. Source: ghsa-malware 87d96242197900f3c78c05f4482747392edaee32046239b89a056617aa109c9d An...
Malicious code in adminbypasser (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 867991d0e6c74f15c2f231c002867172a4e03044a328676cf9b2ec07a7e48f68 Package silently downloads remote code and adds its execution to the autostart. During analysis, the remote domain no longer existed. --- Category: MALICIOUS -...
MAL-2026-774 Malicious code in adminbypasser (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 867991d0e6c74f15c2f231c002867172a4e03044a328676cf9b2ec07a7e48f68 Package silently downloads remote code and adds its execution to the autostart. During analysis, the remote domain no longer existed. --- Category: MALICIOUS -...
CVE-2026-20978
Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...
Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign
Cybersecurity researchers have disclosed details of an active web traffic hijacking campaign that has targeted NGINX installations and management panels like Baota BT in an attempt to route it through the attacker's infrastructure. Datadog Security Labs said it observed threat actors associated...
MAL-2026-758 Malicious code in tailwindcss-forms-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91e47d3466ef7beca3f6d4cc16c77c91c52a3d29dbbe4d484fcf3e2397f18d2c The package tailwindcss-forms-starter was found to contain malicious code. Source: ghsa-malware...
Malicious code in ggajsvjsg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 252c9dd76e4c32a0ba1b698b9123dceda0e8e2f64c9981000193ffcf7c8de22c The package ggajsvjsg was found to contain malicious code. Source: ghsa-malware a2da1379c622300b641484fcb4e4edf2031991129e9db4ad8b070a3186a1085f Any...
CVE-2026-20978
Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...
CVE-2026-20978
Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...
CVE-2026-20978
KnoxGuardManager is affected by an improper authorization vulnerability that allows local attackers to bypass the application’s persistence configuration. This issue is reported across multiple sources (CVE-2026-20978) and is tied to SMR Feb-2026 Release 1 for KnoxGuardManager. Affected component...
CVE-2026-20978
Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...
