7799 matches found
MAL-2026-10964 Malicious code in markscan-utils (npm)
The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...
MAL-2026-10949 Malicious code in @iphouse/api (npm)
The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...
MAL-2026-10948 Malicious code in @akrai/report_new (npm)
The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...
Exploit for CVE-2026-63030
wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-601...
Exploit for CVE-2026-63030
wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A sel...
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands
Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding assistant to apply a maintainer's fix from a GitHub thread, and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the...
metasploitable-vulnerability-mapping-with-nmap
Metasploitable Vulnerability Assessment Network Enumeration...
CVE-2026-10797
creationtimestamp| type| source ---|---|--- 2026-07-14 09:18:49+00:00| seen| https://bsky.app/profile/esetresearch.bsky.social/post/3mqlustra4c24 2026-07-14 09:18:49+00:00| seen| https://bsky.app/profile/esetresearch.bsky.social/post/3mqlusqj43c24 2026-07-14 09:18:50+00:00| seen|...
MAL-2026-10550 Malicious code in better-tailwindcss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...
exploit-library
Exploit Library Personal collection of verified CVE exploits,...
PT-2026-58870
Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The Grav Login plugin allows a top-level GET request to be sent to the task URI parameter via the TaskServiceProvider without requiring a login-form nonce, an Origin check, or a Referer...
PT-2026-58869
Name of the Vulnerable Software and Affected Versions Grav Flex Objects Plugin versions prior to 1.4.3 Description An issue exists where the requireFlexPermission function in classes/Api/FlexApiController.php fails to deny access when a directory blueprint omits config.admin.permissions. This...
Exploit for OS Command Injection in Vsftpd_Project Vsftpd
Detection Engineering & Vulnerability Research - CVE-2011-2523...
Exploit for Improper Authentication in Cisco Catalyst_Sd-Wan_Manager
Executive Summary The CVE-2026-20127 Defensive Companion is a...
MAL-2026-10136 Malicious code in transform-es2015-sticky-regex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1 package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at...
Malicious code in transform-es2015-sticky-regex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1 package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at...
security-research
security-research Personal CVE PoC repository — exploit scrip...
exploitarium
https://discord.gg/WytKH65ZR join up for research, help, documen...
PYSEC-2026-1581 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...