18525 matches found
PT-2026-55205
Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 3.1.1 Description The @sigstore/verify library incorrectly derives a transparency-log timestamp from the tlogEntries.integratedTime variable for bundle v0.2 inclusionProof-only entries. Because the inclusion proof...
MAL-2026-6697 Malicious code in @sudoughnym/enviro-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c1c204d0f458d13d7140f4b7a007d551095665a418e9146037be9a5b2b7957 @sudoughnym/[email protected] ships preinstall.js and postinstall.js lifecycle scripts that run automatically on npm install. Both scripts collect...
GHSA-QQW8-7C2R-JXCH Sigstore Java has a vulnerability with bundle verification of integratedTime
Summary Regression: Verification of integratedTime from Rekor V1 Log Entry against Fuclio Certificate validity was missing Details - PR 1008 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. - PR 1185 re-added this verification with enhancements...
Exploit for CVE-2026-31694
FUSE readdir cache out-of-bounds write PoC Local proof of con...
exploitarium
If you wish to collaborate/discuss with me, contact me on discor...
0-day-PoC-Repo
If you wish to collaborate/discuss with me, contact me on discor...
Exploit for CVE-2026-43503
CVE-2026-43503 DirtyClone - PoC - SecurewithUmer POC of Dir...
exploitarium-fork
If you wish to collaborate/discuss with me, contact me on discor...
PYSEC-2026-477 PraisonAI has critical RCE via `type: job` workflow YAML
praisonai workflow run loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py. This supports: - run: → shell command execution via subprocess.run - script: → inline Python execution via exec - python: → arbitrary Python script execution A malicious YAML...
exploitarium
If you wish to collaborate/discuss with me, contact me on discor...
Malicious code in yandex-geobase (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6219d513896736aee31ce33719d6ae2d1f5b03293ecdfe884d944bbb3eb99a [email protected] squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTTP GET to a hardcoded bare-...
MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...
Exploit for CVE-2026-43503
DirtyClone DirtyClone is a C-based local privilege escalation...
Exploit for CVE-2026-5366
CVE-2026-5366 P...
[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-9.fc44
Simple JavaScript proof-of-work based access for Nginx with virtually no over head...
CVE-2026-47073
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:56+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf...
CVE-2026-49358
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:52+00:00| published-proof-of-concept| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g...
CVE-2026-49342
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:42+00:00| published-proof-of-concept| https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8...