medusa

🐍 MEDUSA - AI 安全扫描器 AI 优先的安全扫描器，拥有 40,000+ 检测模式，覆盖 AI/ML、代理和 LLM 应用。 🤖 开箱即用 - 无需安装任何工具。 🚨 200 个 CVE：Log4Shell、Spring4Shell、XZ Utils、LangChain RCE、MCP-Remote RCE、React2Shell 🔥medusa scan --git — 扫描任意仓库以发现 AI 供应链攻击（仓库投毒、提示注入、MCP 工具投毒） 🔐medusa secrets scan — 在你的 Claude / Cursor / Copilot / shell...

veilgate

VeilGate VeilGate 是一个开源欺骗代理，适用于希望通过提高自动安全探测成本而不在真实用户面前设置脆弱阻断规则的团队。 它位于 Web 应用之前，对每个请求进行评分，并选择三种结果之一： Real ：将干净流量转发到上游应用。 Challenge ：要求可疑但模棱两可的客户端解决浏览器工作量证明。 Tarpit ：将高置信度代理流量分流到确定性虚假应用。 目标不是魔法般的不可攻破。目标是更好的经济学：让人类和正常自动化流畅运行，同时让 AI 辅助的扫描器将时间、代币和注意力浪费在可信的死胡同里。 功能 反向代理，支持 observe、challenge、tarpit...

CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 —— CyberPanel AI Scanner 未认证读写 API 访问 适用于 CyberPanel 2.4.4 之前版本的 CVE-2026-41473 Nuclei 检测模板。 漏洞 CyberPanel 的 AI Scanner 功能暴露了两个无需认证即可访问的 API 端点： Endpoint| Method| Impact ---|---|--- /api/ai-scanner/list-api-keys| GET| 泄露管理员用户名、API 密钥前缀、托管的域名和扫描 ID /api/ai-scanner/callback| POST|...

CVE-2026-41472-POC

CyberPanel XSS 到 RCE CVE-2026-41472 一键通过未经认证的 API 端点在 CyberPanel v2.4.3 中实现远程代码执行。 概述 该漏洞利用链串联了 CyberPanel AI Scanner 功能中的多个漏洞： 1. 未认证的数据库注入 /api/ai-scanner/callback 无需认证即可接受任意数据 2. 存储型 XSS 恶意载荷在管理后台未经净化即被渲染 3. CSRF 到 RCE XSS 劫持管理员会话以创建恶意 cron 任务 受影响版本 CyberPanel ≤ 2.4.3 时间线 2025 年 12 月 16 日 漏洞已报...

CVE-2026-87820

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-87820 CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-87820

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that leak administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata . This allows unauthenticated attackers to enumerate panel administrators and recent scanner ac...

CVE-2026-87820 CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

EUVD-2026-74846

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-87820 CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

PT-2026-88958

Name of the Vulnerable Software and Affected Versions CyberPanel versions 2.4.3 through 2.4.5 Description Unauthenticated AI Scanner debugging endpoints expose sensitive information, including administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. This...

CVE-2026-87820: Exposure of Sensitive Information to an Unauthorized Actor

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-41512

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

CVE-2026-41512

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

EUVD-2026-28599

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

CVE-2026-41512: Improper Control of Generation of Code

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

CVE-2026-41473

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback...

CVE-2026-41472

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findingsjson field of...

CVE-2026-41473

CyberPanel before 2.4.4 is affected by an authentication bypass in the AI Scanner worker API endpoints. The endpoints /api/ai-scanner/status-webhook and /api/ai-scanner/callback allow unauthenticated remote writes to the database, enabling storage exhaustion DoS, corruption of scan history, and p...