918 matches found
subjack
subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...
kubeaudit
It is now a requirement for clusters to run Kubernetes =1.19. override labels with unregistered kubernetes.io annotations will be deprecated. It'll soon be a requirement to use kubeaudit.io instead. Refer to this discussion for additional context. 🚨 Deprecation Notice 🚨 Kubeaudit is planned for...
poc
T4 PoC — @shopify/theme-check-node auto-glob RCE Shopify Th...
CVE-2026-92527
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2026-92527
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2026-92527 chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
EUVD-2026-81136
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2026-92527
A server-side request forgery (SSRF) vulnerability affects chatwoot versions up to 4.17.1 in the Shopify OAuth component, specifically in the file callbacks_controller.rb . The root cause involves manipulation of an unknown function within that file, enabling a remote attacker with low privileges...
CVE-2026-92527 chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2026-92527 chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2026-92527: Server-Side Request Forgery (SSRF)
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
PT-2026-94022
Name of the Vulnerable Software and Affected Versions chatwoot versions prior to 4.17.2 Description A server-side request forgery SSRF issue exists within the Shopify OAuth component, specifically affecting the callbacks controller.rb file. This flaw allows remote attackers to manipulate requests...
CVE-2026-45618 LiquidJS is Vulnerable to Remote Code Execution
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the currentshopifydomain helper. An attacker can gain unauthorized access to resources belonging to a different shop by sending a request authenticated for one shop while including a different shop in the quer...
MAL-2026-10487 Malicious code in @outsmartly/metaobjects (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller...
Malicious code in @outsmartly/metaobjects (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller...
PT-2026-56536
Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.1 Description The pop array filter at src/filters/array.ts allocates a full clone of its input array using ...toArrayv without calling this.context.memoryLimit.use.... This allows a template render, such as hug...
Malicious Package
Overview shopify-internel is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-6941 Malicious code in shopify-internel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb1d4e4e70cff6efbfec48cbf205e071c73a70003863e2293dbf7035547f560 Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify namespace. The tarball...
Malicious code in shopify-internel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb1d4e4e70cff6efbfec48cbf205e071c73a70003863e2293dbf7035547f560 Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify namespace. The tarball...