subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

kubeaudit

It is now a requirement for clusters to run Kubernetes =1.19. override labels with unregistered kubernetes.io annotations will be deprecated. It'll soon be a requirement to use kubeaudit.io instead. Refer to this discussion for additional context. 🚨 Deprecation Notice 🚨 Kubeaudit is planned for...

CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

CVE-2026-63414

The Shopify App Rails engine (versions 22.1.0 through 23.0.3 ) contains a vulnerability where token-exchange authenticated controllers can expose a request-derived shop context. Specifically, the current_shopify_domain helper could resolve to a sanitized shop query parameter instead of the identi...

CVE-2026-63414 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

EUVD-2026-114553

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, token-exchange authenticated controllers can expose a request-derived shop context instead of the identity from a verified Shopify ID token or active Shopify session. currentshopifydomain can resolve to the...

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

GHSA-6J52-38F8-QHXR Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active...

PT-2026-133238

In token-exchange authenticated controllers, shopify app exposes shop context through helpers such as current shopify domain. Prior to the fix, current shopify domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or...

PT-2026-133263

Name of the Vulnerable Software and Affected Versions Shopify App versions 22.1.0 through 23.0.2 Description In token-exchange authenticated controllers, the software exposes shop context through helpers such as current shopify domain. The current shopify domain helper can resolve to the sanitize...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

poc

T4 PoC — @shopify/theme-check-node auto-glob RCE Shopify Th...

Malicious code in kitchen-shopify-provisioner (npm)

The package kitchen-shopify-provisioner was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kafka-shopify (npm)

The package kafka-shopify was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-92527

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

EUVD-2026-81136

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-92527 chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...