Exploit for CVE-2026-61511

cve-id Donate Support the maintenance of this project wit...

Exploit for Command Injection in Microsoft

cve-id Donate Support the maintenance of this project wit...

Exploit for Improper Authorization in Microsoft

cve-id Donate Support the maintenance of this project wit...

Exploit for CVE-2026-16723

cve-id Donate Support the maintenance of this project wit...

Exploit for CVE-2026-64600

cve-id Donate Support the maintenance of this project wit...

Exploit for CVE-2026-6875

cve-id ⚡ Simple Usage Use this project only in safe and...

Exploit for CVE-2026-61498

cve-id ⚡ Simple Usage Use this project only in safe and...

MAL-2026-10951 Malicious code in @markscan/api (npm)

The @markscan/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10961 Malicious code in markscan-api (npm)

The markscan-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10963 Malicious code in markscan-reports (npm)

The markscan-reports package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

MAL-2026-10964 Malicious code in markscan-utils (npm)

The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

MAL-2026-10962 Malicious code in markscan-core (npm)

The markscan-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10954 Malicious code in @markscan/utils (npm)

The @markscan/utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms ...

MAL-2026-10949 Malicious code in @iphouse/api (npm)

The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10948 Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

Exploit for CVE-2026-15410

cve-id ⚡ Simple Usage Use this project only in safe and...

MAL-2026-10550 Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

exploit-library

Exploit Library Personal collection of verified CVE exploits,...

PT-2026-58870

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The Grav Login plugin allows a top-level GET request to be sent to the task URI parameter via the TaskServiceProvider without requiring a login-form nonce, an Origin check, or a Referer...

PT-2026-58869

Name of the Vulnerable Software and Affected Versions Grav Flex Objects Plugin versions prior to 1.4.3 Description An issue exists where the requireFlexPermission function in classes/Api/FlexApiController.php fails to deny access when a directory blueprint omits config.admin.permissions. This...