Exploit for CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated RCE Unaut...

Malicious code in hridoy-ultimate (npm)

Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in module/loginHelper.js forwards caller-supplied Facebook emai...

CVE-2026-19735

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...

ExploitX

👻 ExploitX An autonomous, MCP-powered CTF-solving platfor...

CVE-2026-19735 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...

EUVD-2026-97114

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...

CVE-2026-19735

The Zephyr TCP stack contains a vulnerability where the RFC 6528 initial-sequence-number (ISN) implementation may use predictable values. If the sys_csrand_get() call fails during early boot (e.g., due to -ENODEV or -EIO from the entropy driver), the system fails to catch the error and leaves the...

Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17446 Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17803 Malicious code in hridoy-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in...

Malicious code in hridoy-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in...

Malicious code in wallet-balance-scanner (RubyGems)

Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during gem...

Malicious code in xrp-ledger-utils (RubyGems)

Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a randomized 20-40 minute sleep. The payload opens a TCP...

Malicious code in wallet-hd-derive (RubyGems)

Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install auto-executes it. extconf.rb decodes a base64-encoded Ruby...

Malicious code in staking-apr-fetcher (RubyGems)

Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install. The payload double-forks a detached background process th...

Malicious code in tron-trc20-utils (RubyGems)

Source: amazon-inspector c840b18eadc331896e56720bc9a00f1239807542202bbd4ff9636737f27d0142 The gem's extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached double-forked child during gem install. The decoded code opens a TCP connection to 45.138.12.177:8089...

Malicious code in web3-signer-kit (RubyGems)

Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is redirected to /dev/null. The decoded payload opens a TCPSocket to...

Malicious code in seed-phrase-validator (RubyGems)

Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a base64-encoded Ruby payload and runs it via eval inside a detached fo...

Malicious code in evm-tx-decoder (RubyGems)

Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detached child Process.setsid, Process.detach. The payload opens...

Malicious code in btc-fee-estimator (RubyGems)

Source: amazon-inspector ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c The gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during gem install. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on...