apex-kev-change-desk

Apex KEV Change Desk An offline change-review prototype for IT teams comparing two CISA Known Exploited Vulnerabilities KEV JSON snapshots. It reports added, removed and edited records, including exact before/after values for every changed field. It is a data-review utility, not a security...

CVE-2025-5777-TrendMicro-ApexCentral-RCE

🚨 CVE-2025-5777 – Trend Micro Apex Central Auth Bypass + RCE 🔎 Overview CVE-2025-5777 is a critical authentication bypass and remote code execution RCE vulnerability discovered in Trend Micro Apex Central. It allows unauthenticated attackers to execute arbitrary commands on the system by abusing ...

rtx-cve-2023-45779

This repository is provided AS IS to accompanya Meta Red Team X vulnerability disclosure. It is not an official Meta project and will not be supported like one. A set of scripts and artifacts that demonstrate detection and exploitation of Android devices that ship APEXes signed with test keys fro...

ConscryptTrustUserCerts

Magisk - Conscrypt Trust User Certs This module makes all installed user certificates part of the APEX module com.android.conscrypt certificate store in Android 14, so that they will automatically be used when building the trust chain. Installation 1. Install Magisk 2. Zip files zip -r...

apex

Pensar Apex AI-powered penetration testing using autonomous agents — directly in your terminal. Run blackbox and whitebox pentests that explore, reason, and surface real vulnerabilities. Want to run from the cloud or integrate it with your CI/CD? See Pensar Console. Use Cases Developers Run...

APEX

APEX previously AzurePwn- Azure Post Exploitation Framework An attempt to ease up post ex tasks once we have access to some sort of credentials to an Azure related account. To be honest it is nothing new or spectacular. Just my old lazy ass doing some shortcuts so I don't need to remember all the...

APEX_official

APEX The repository separates the APEX defender, benchmark data normalization, trusted capability manifests, and comparison-method integrations so that each layer can be inspected independently. Installation python -m venv .venv source .venv/bin/activate pip install -e '.test' export...

Malicious code in @fmr-ap153177/apex-kit-icons (npm)

Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz instead of a registry version range. On npm install, npm...

EUVD-2026-105934

Vulnerability in Oracle APEX component: General. Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this...

CVE-2026-101521

Vulnerability in Oracle APEX component: General. Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this...

CVE-2026-101521

A critical vulnerability in Oracle APEX (component: General) affects versions 24.1.0-24.1.21 , 24.2.0-24.2.20 , and 26.1.0-26.1.4 . This easily exploitable flaw allows an unauthenticated attacker with network access via HTTPS to compromise the system, potentially leading to a complete takeover of...

PT-2026-119206

Name of the Vulnerable Software and Affected Versions Oracle APEX versions 24.1.0 through 24.1.21 Oracle APEX versions 24.2.0 through 24.2.20 Oracle APEX versions 26.1.0 through 26.1.4 Description An unauthenticated attacker with network access via HTTPS can compromise Oracle APEX. Successful...

Malicious code in @apexacc/cli (npm)

@apexacc/cli is distributed by "Apex Accelerator" Apex Arena, a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs REF8801, published 2026-10-12 found it is a repackaged Oh My Pi coding agent 1,351 of 1,363 files identical with malicious...

Malicious code in @fmr-ap149494/apex-base-component (npm)

Source: ossf-package-analysis e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9 The OpenSSF Package Analysis project identified '@fmr-ap149494/apex-base-component' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated wit...

Malicious code in @fmr-ap149494/apex-base-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e582d9d611f75576135d06bf83cf71b60a58fbbf475ba61e656bf190a73c5546 The package ships only an empty stub index.js exports and a manifest whose sole dependency, ltidisafe, is declared as a bare HTTPS tarball URL...

MAL-2026-17929 Malicious code in @fmr-ap149494/apex-base-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e582d9d611f75576135d06bf83cf71b60a58fbbf475ba61e656bf190a73c5546 The package ships only an empty stub index.js exports and a manifest whose sole dependency, ltidisafe, is declared as a bare HTTPS tarball URL...

APEX: Active Protection at Execution Boundaries for LLM Agents

Indirect prompt injection IPI hides adversarial instructions in content that large language model LLM agents read at runtime. As agents compose heterogeneous capability units, including Tools, MCP servers, and Skills, the carriers of injection multiply, and defenses built to recognize attack...

Chaining Skills to Hijack LLM Agents

LLM agents use skills to improve performance on specialized tasks. To complete a user request, an agent may invoke several skills in sequence, allowing information produced under one skill to guide the next. Because skills may come from open-source repositories, this handoff can also carry...

EUVD-2026-84985

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

EUVD-2026-84984

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...