redamon v6.2.5

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

AI-Infra-Guard v4.5.0

📖 Documentation | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский 🚀 AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard integrates capabilities such as ClawScanOpenClaw Security Scan, Agent Scan，AI infra vulnerability scan, MCP Server &...

opencode v1.18.9

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Xalgorix Autonomous AI Pentesting Agent 4.5.100

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

CVE-2026-18236: Incorrect Authorization

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

ROS-20260729-73-0008

The vulnerability in exim is related to the comparison of numerical ranges without any minimum checks. Exploiting this vulnerability can allow an attacker to cause a service failure...

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasing...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5881 more potentially affected by CVE-2026-59921 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-59921 Source advisory: MEND:CVE-2026-59921...

oxo v2.9.17

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893

The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...

CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: spire-server, cert-manager, aactl, reports-server, backup-restore-operator, kaf, omnictl-multiarch, commercial-kyverno, elastic-agent-fips, prometheus, falco-no-driver, prometheus-mongodb-exporter, nerdctl, minio, zitadel, k3d, cilium, snyk-cli, loki,...

Aembit Joins Snowflake to Tackle AI’s Next Security Frontier: Trusted Agent Interoperability

Silver Spring, MD, USA, 28th July 2026, CyberNewswire...

opencode v1.18.8

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...