udpx

高速かつ軽量、UDPXはGoで書かれたシングルパケットUDPスキャナで、45以上のサービスの発見をサポートし、カスタムサービスの追加も可能です。使いやすくポータブルで、Linux、Mac OS、Windowsで実行できます。zgrab2やzmapのようなインターネット全体をスキャンするツールとは異なり、UDPXは移植性と使いやすさを重視して設計されています。 高速です。単一サービスの場合、/16ネットワーク全体を約20秒でスキャンできます。 libpcapやその他の依存関係をインストールする必要はありません。 Linux、Mac...

udpx

Fast and lightweight, UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add custom ones. It is easy to use and portable, and can be run on Linux, Mac OS, and Windows. Unlike internet-wide scanners like zgrab2 and zmap, UDPX is...

AI-FILE

AIfile aifile 是一个 Mythic C2 profile，它使用公开文档化的 OpenAI Files API，通过 jsonl 文件而非传统的 HTTP/S 监听器来交换植入体消息。它依赖于 OpenAI 在公开文档中定义的 Files API 行为：https://developers.openai.com/api/docs/guides/file-inputs?api-mode=responses。 监听器轮询 /v1/files 端点以查找带有 purpose=batch 的 .jsonl 文件，在本地解密每个请求信封，将原始 Mythic 消息字节转发到 Myth...

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

argus-poc-index

argus-poc-index Public ARGUS metadata, maintained independent...

MAL-2026-13376 Malicious code in claude-remote-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In...

GHSA-2CJR-5V3H-V2W4 Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations

Summary A prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the applyUpdate and updateRecord functions which use Object.assign to merg...

GHSA-XVWW-XHX6-22PF SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

Summary A path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into charactername. Details charactername is used unsafely as part of the destination filename and...

PT-2026-29660

Summary A path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character name. Details character name is used unsafely as part of the destination filename an...

CVE-2026-33572: Creation of Temporary File With Insecure Permissions

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output...

PT-2026-28776

openclaw created new session transcript JSONL files with overly broad default permissions in affected releases. On multi-user hosts, other local users or processes could read transcript contents, including secrets that might appear in tool output. Affected Packages / Versions - Package: openclaw...

OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: OpenClaw - OpenClaw -- VULNERABILITY DETAILS...

Malicious code in @zalastax/nolb-jsonl (npm)

The package @zalastax/nolb-jsonl was found to contain malicious code...

MAL-2025-12140 Malicious code in @zalastax/nolb-jsonl (npm)

The package @zalastax/nolb-jsonl was found to contain malicious code...

CVE-2025-6233

Mattermost versions 10.8.x = 10.8.1, 10.7.x = 10.7.3, 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal...

CVE-2025-6233 Arbitrary file read by system admin via path traversal

Mattermost versions 10.8.x = 10.8.1, 10.7.x = 10.7.3, 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal...

CVE-2025-6233: Improper Limitation of a Pathname to a Restricted Directory

Mattermost versions 10.8.x = 10.8.1, 10.7.x = 10.7.3, 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal...