SUSE-SU-2026:3649-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. - CVE-2026-0864: improper handling of...

Security update for python313

This update for python313 fixes the following issues: CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. CVE-2026-0864: improper handling of...

secator v0.42.0

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

OPENSUSE-SU-2026:21593-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

OPENSUSE-SU-2026:21592-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

Malicious code in homekit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aae79beeec5e53410060b09eae14979ac2c1f27c62da6b750a612651f8ea8fe The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js resolves the installer's ema...

MAL-2026-14297 Malicious code in homekit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aae79beeec5e53410060b09eae14979ac2c1f27c62da6b750a612651f8ea8fe The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js resolves the installer's ema...

BIT-POSTGRESQL-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a C...

BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

BIT-ELASTICSEARCH-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

MAL-2026-14295 Malicious code in mcp-dev-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...

Malicious code in mcp-dev-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...

Malicious code in de-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-regist...

MAL-2026-14264 Malicious code in de-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-regist...

Redis_Pwn

Redis Rogue PWN Enhanced Redis rogue server exploit for CTF...

CyberChef v11.4.0

CyberChef The Cyber Swiss Army Knife CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps,...

Exploit for Deserialization of Untrusted Data in Citrix Session_Recording

cve-id Donate Support the maintenance of this project wit...

Exploit for CVE-2026-56848

CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2...

dnscontrol v5.0.0-rc9

DNSControl DNSControl is Infrastructure as Code for DNS. It includes a full-featured configuration language Javascript-compatible, plus "plug-ins" that speak to DNS provider APIs such as AWS Route 53, Cloudflare, and Gandi. It can send the same DNS records to multiple providers. It runs anywhere ...

Malicious code in flydev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8d7456b5f0f3d2d3115eed9624272036cad1316cd50ee05e4134e5fa30f8ca The package advertises itself as a generic 'Utility' but ships a purely destructive payload hidden under a deeply nested single-letter directory tree...