golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

Malicious code in journey-test-helloshell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b setup.py registers a custom install command cmdclass install hook and also fires at module import that connects to the hardcoded bare-IP endpoint...

Exploit for CVE-2026-109618

php2shell-check bash sudo python3 php2shellcheck.py...

Exploit for CVE-2026-109618

🍉 php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-auth re...

CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall Discoverer : Golden Ticket Labs Vendor : Unitech pm2 Date Assigned : August 20, 2025 MITRE Description An issue in the lib/API/Modules/NPM.js component of Unitech PM2 v5.4.2 allows arbitrary code execution by installing packages with...

CVE-2026-92206

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a...

Exploit for CVE-2026-109618

php2shell-detect Non-destructive detection toolkit and vers...

CVE-2025-10352-POC

CVE-2025-10352 POC - Admin Account Creation 🛠️ POC for CVE-2025-10352: An unauthenticated endpoint in Melis Platform melis-core that allows creation of an administrator account via a crafted HTTP request to a specific admin endpoint. 🔗 References 📄 CVE-2025-10352 on MITRE 📄 Melis Platform Warning...

Exploit for CVE-2026-109618

PHP Vulnerability Exposure Scanner An interactive Bash utilit...

DRUPAL-CONTRIB-2026-253

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...

DRUPAL-CONTRIB-2026-252

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these...

DRUPAL-CONTRIB-2026-251

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...

DRUPAL-CONTRIB-2026-249

This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them. The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form. This...

DRUPAL-CONTRIB-2026-248

The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors. The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the...

DRUPAL-CONTRIB-2026-247

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private fi...

DRUPAL-CONTRIB-2026-246

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be...

DRUPAL-CONTRIB-2026-245

This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This...

DRUPAL-CONTRIB-2026-244

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacke...

MAL-2026-18180 Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...