doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

save-pixels-updated

This is an updated version of save-pixels which patches the CVE-2020-8175 security issue. At the time of creation, every file is the same as the ones from the original repository, excluding the package.json. save-pixels-updated The following is from the save-pixels GitHub page. As mentioned befor...

get-pixels-updated

This is an updated version of get-pixels which patches the CVE-2020-8175 security issue. At the time of creation, every file is the same as the ones from the original repository, excluding the package.json. get-pixels-updated The following is from the get-pixels GitHub page. As mentioned before,...

PT-2026-117633

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max pixels limit when system.images.url actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or...

RUSTSEC-2026-0373 Missing case-insensitive matching for CSS url function

URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS url"" is matched case-sensitively, when it should be matched case-insensitively. As a result, while url"" gets the intended domain name filtering, URL...

Malicious code in web-pixels-manager (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the ffhevcputhevcepelpixels8sse function in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a crafted video file...

MAL-2026-17895 Malicious code in web-pixels-manager (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the...

Malicious code in web-pixels-manager (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the...

Malicious Package

Overview web-pixels-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Astra Linux – Vulnerability in libsdl2, libsdl1.2

There is a heap overflow issue in the video/SDLpixels.c file in SDL Simple DirectMedia Layer versions 2.x to 2.0.18. By creating a malicious .BMP file, an attacker can cause the application using this library to crash, result in a denial of service, or lead to code execution...

CVE-2026-56735

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

EUVD-2026-87215

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

PT-2026-98949

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description The HTML sanitizer HtmlSanitizer::Strict fails to block external URLs within the srcset attribute of tags. While other external URLs are blocked to prevent remote conten...

PT-2026-96656

Name of the Vulnerable Software and Affected Versions Image Buzz versions prior to 1.0.4 Description The Image Buzz plugin for WordPress contains missing authorization checks, allowing unauthenticated attackers to modify API keys configured by site administrators. This is achieved by manipulating...

Astra Linux – Vulnerability in libsdl1.2, libsdl2

In SDLGetRGB in the video/SDLpixels.c file, there is a heap-based buffer over-read issue in versions from 1.2.15 up to 2.x, and from 2.0.9 onwards...

Lightweight Detection of Electromagnetic Signal Injection Attacks on Image Sensors

Electromagnetic signal injection attacks ESIA pose a growing threat to image sensors, which are increasingly used in different intelligent systems. By emitting electromagnetic interference, adversaries can manipulate pixel values, potentially misleading downstream artificial intelligence AI model...

PT-2026-80638

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...