CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

crowbar

crowbar Retrieve CVEs and index them inside your codebase...

CVE-2026-105930

In Apache Pulsar , an improper authorization flaw allows an authenticated user to perform a cross-tenant package download. When package management is enabled, the Pulsar Functions worker fails to verify if a requesting user has permissions to access a package URL from a different namespace. Inste...

EUVD-2026-107428

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...

CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and...

MAL-2026-18180 Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

MAL-2026-18181 Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

MAL-2026-18182 Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

SSCMS_Decrypt

sscms siteserver cms database decrypt Introduction: SSCMS is based on .NET Core, enabling you to set up a fully functional, high-performance, large-scale, and easy-to-maintain website platform in the shortest time, at the lowest cost, and with the least manpower. Project address:...

CVE-2024-36587

CVE-2024-36587 - dnscrypt-proxy Local Privilege Escalation Overview Vulnerability Description : When installing the dnscrypt-proxy service, it trusts and registers executables in the current directory, allowing privilege escalation by inserting a malicious binary. Affected Versions : dnscrypt-pro...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

zarp

Introduction Zarp is a network attack tool centered around the exploitation of local networks. This does not include system exploitation, but rather abusing networking protocols and stacks to take over, infiltrate, and knock out. Sessions can be managed to quickly poison and sniff multiple system...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

CVE-2025-49844-Vulnerability-Scanner

CVE-2025-49844 RediShell Vulnerability Scanner A comprehensive vulnerability scanner for testing Redis instances against the critical CVE-2025-49844 RediShell vulnerability. About the Vulnerability CVE ID : CVE-2025-49844 Name : RediShell CVSS Score : 10.0 Critical Type : Use-After-Free UAF in Lu...

Blackash-CVE-2025-61884

CVE-2025-61884 New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login 💀 CVE-2025-61884 — Complete summary 🧾💥 Field| Details ---|--- Identifier| CVE-2025-61884 Product| Oracle E-Business Suite — Oracle Configurator Runtime UI Affected versions| 12.2.3 → 12.2.14 Attack vector|...