Malicious code in bitcoin-rpc-lite (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-31431-check

CVE-2026-31431 check Read-only checker for the algifaead local-root vuln CVE-2026-31431. Looks at kernel config, module state, AFALG socket reachability, and any mitigations you've put in place, then prints a verdict. It does not run exploit code. Companion to dirty-frag-check CVE-2026-43284 /...

CVE-2024-36971

CVE-2024-36971 — Proof of Concept Research & Analysis Only ⚠️ DISCLAIMER — READ BEFORE USING THIS REPOSITORY This repository is intended only for defensive research, analysis, and responsible reporting. It contains a non-exploitable proof of concept file named CVE-2024-36971 and a publicly...

MAL-2026-17343 Malicious code in @bellaxchuu/crystalred (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17383 Malicious code in @xatancchii/velycxbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @xatancchii/velycxbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17404 Malicious code in saturn-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Dirty-Frag

💥 CVE-2026-43284 — Dirty Frag 💥 ⚡ Prueba de Concepto de Escalada de Privilegios Local de Dirty Frag ⚡ 📖 Descripción Este repositorio contiene una Prueba de Concepto PoC para: CVE-2026-43284 — Dirty Frag El exploit demuestra una vulnerabilidad que afecta a sistemas Linux vulnerables. 🧠 Acerca de...

CVE-2023-7231

CVE-2023-7231 – Critical SSRF → Memcached/Docker RCE Chain via Audible fetchResource 🔥 Summary This vulnerability enables Server-Side Request Forgery SSRF in Audible’s fetchResource API on .audible.com, allowing unauthenticated attackers to pivot into internal infrastructure. Through SSRF payload...

CVE-2024-415770-ssrf-rce

CVE-2024-415770-SSRF-RCE Description This script is designed to interact with the teamserver. Update the script with your teamserver URL. It performs several steps to register an agent, open a socket, and inject an SSH key into the target's authorized keys. Prerequisites Python 3.x Required Pytho...

CVE-2017-2671

Linux kernel CVE-2017-2671 Local Denial of Service Vulnerability what !! CVE-2017-2671 1 Linux kernel CVE-2017-2671 Local Denial of Service consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service panic by leveraging access to the...

react2shell-CVE-2025-55182

React2Shell Exploit CVE-2025-55182 Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support. 🚀 Quick Start Clone & run git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3 exploitreact2shell.py "" 📖 Usa...

BlueBorn

BlueBorn CVE-2017-0785 Archlinux installation paru -S python-pybluez-git bluez-utils-compat pyhton3 python3-pip sudo pip install pwn TUTORIALS Discovery hcitool scan Scanning ... XX:XX:XX:XX:XX:XX Device 1 XX:XX:XX:XX:XX:XX Device 2 Use the exploit python CVE-2017-0785.py TARGET=XX:XX:XX:XX:XX V...

kcmd

kcmd - Kankun Sniffer and Hijacker Send encrypted ON/OFF commands to kankun smart sockets Sniff the commands on the network to extract password Copyright 2015 © Payatu Author: Aseem Jakhar aseematpayatudotcom Websites: www.payatu.com www.nullcon.net www.hardwear.io www.null.co.in This program is...

Windows-WinSock-UAF-Mitigation

CVE-2026-68820: Mitigación de UAF en Windows WinSock afd.sys Este repositorio contiene un parche conceptual que demuestra la mitigación para CVE-2026-68820 , una vulnerabilidad crítica de Use-After-Free UAF en el controlador de función auxiliar de Windows para WinSock afd.sys. La explotación acti...

cve-2017-11176

cve-2017-11176 Public Information The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service use-after-free or possibly have...

Venom

Venom Venom is a C++ library that is meant to give an alternative way to communicate, instead of creating a socket that could be traced back to the process, it creates a new "hidden" there is no window shown detached edge process edge was chosen because it is a browser that is installed on every...

Rocky Linux 9 [CIQ] Security Update: gvfs / gvfs-client / gvfs-client-debuginfo / gvfs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_74370)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674370 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

bad_garbage

BADGARBAGE.c CVE-2026-53361 — un use-after-free sin privilegios y capaz de escapar del contenedor en el recolector de basura de sockets AFUNIX. Esta es la versión de vector único solo MSGPEEK. El fallo El GC de AFUNIX recupera los sockets «in-flight» que forman ciclos de referencia inalcanzables...