CVE mentions, exploit signals, and PoC evidence in one fast public view.
Loading current evidence
Historical archive search
Search decades of CVEs by regex, severity, date, CWE, vendor/product tags, KEV, PoC, and other evidence.
Results
96 results · Sorted by Highest Buzz score first
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploit…
Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the pack…
discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.
The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Every filter state lives in the URL so you can bookmark, share, and crawl exact historical slices instead of a client-only search session.
Buzz order uses the latest all-time evidence snapshot, refreshed every two hours. Evidence-bearing CVEs rank first; records without a snapshot continue newest-first.