BiblioRCE

An oversight within BiblioCraft which allows restricted server-side file manipulation. This method only requires BiblioCraft! Not too much trickery and no other mods are required to achieve code execution! CoreTweaks The original writeup focused on CoreTweaks can be found here. I recommend you re...

kin

A new foundation for code. Kin is a graph-native code repository for AI agents and the people who build with them. It stores source, recorded code relationships, and versioned history as repository state. The graph is the repository model, not a search index maintained beside another repository...

Exploits

Exploits Some Exploits I've written...

Atlassian Jira Service Management Data Center and Server 3.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16795)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16795 advisory. - In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: NFS: Do not corrupt the value of pgbyteswritten in nfsdorecoalesce The value of mirror-pgbyteswritten should only be updated after a successful attempt to flush out the requests on the list...

kin

Una nueva base para el código. Kin es un repositorio de código nativo de grafos para personas y agentes de IA. Almacena el código fuente, las relaciones de código registradas y el historial versionado como estado del repositorio. El grafo es el modelo del repositorio, no un índice de búsqueda...

ffuf

ffuf - Fuzz Faster U Fool Un fuzzer web rápido escrito en Go. Instalación Ejemplo de uso Descubrimiento de contenido Descubrimiento de vhost Fuzzing de parámetros Fuzzing de datos POST Uso de mutador externo Archivos de configuración Ayuda Modo interactivo Instalación Descarga un binario...

sak1to-shell

sak1to-shell Servidor c2 multi-hilo, multi-sistema/plataforma Linux/Windows y cliente de shell TCP inversa para Windows, ambos escritos en C. Compilando el cliente de shell TCP inversa con i686-w64-mingw32-gcc: i686-w64-mingw32-gcc sakitorevshell.c lib/windows/sakitowincore.c -o sakitorevshell.ex...

kin v0.6.4

A new foundation for code. Kin is a graph-native code repository for people and AI agents. It stores source, recorded code relationships, and versioned history as repository state. The graph is the repository model, not a search index maintained beside another repository. Functions, types, and th...

kin v0.5.10

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...

kin v0.5.8

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...

MAL-2026-13553 Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...

MAL-2026-13571 Malicious code in dolyame-ui-generateid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct...

kin v0.5.5

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...

kin v0.5.3

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

MAL-2026-12528 Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

MAL-2026-12609 Malicious code in claims-block-visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint,...