GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: omnictl-multiarch, cilium, snyk-cli, k3d, containerd, kaf, aactl, upwind-agent, commercial-grafana, falco-no-driver, backup-restore-operator, zitadel, omnictl-multiarch-fips, loki, terraform, telegraf, elastic-agent-fips, zot, helm, minio, prometheus-mongodb-exporter...

Aembit Joins Snowflake to Tackle AI’s Next Security Frontier: Trusted Agent Interoperability

Silver Spring, MD, USA, 28th July 2026, CyberNewswire...

opencode v1.18.8

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

CVE-2026-66138

A vulnerability was found in Ironic-Python-Agent's IPA time syncing code. The value of the ntpserver configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root...

Joomla HTTP Header Unauthenticated - Remote Code Execution Detection

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015 !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! 1.""" from kittysploit import from...

Oracle Access Manager - Remote Code Execution Detection

The Oracle Access Manager portion of Oracle Fusion Middleware component: OpenSSO Agent is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with...

Hashicorp Consul Agent - Detect

Hashicorp Consul Agent was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hashicorp Consul Agent was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hashicorp Consul Agent - Detect', 'description':...

Jenkins Sidepanel - Unauthorized Agent/Queue Exposure Detection

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget...

LANDESK(R) Management Agent Detect

Detects LANDESKR Management Agent Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LANDESKR Management Agent Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LANDESKR Management Agent Detect',...

SuperAGI Panel - Detect

SuperAGI panel was detected. SuperAGI was an open-source autonomous AI agent platform that enables building, managing, and running AI agents. Exposed instances may allow unauthorized access to agent configurations and execution environments. !/usr/bin/env python3 -- coding: utf-8 -- """SuperAGI...

OpenHands Panel - Detect

OpenHands formerly OpenDevin was detected. OpenHands is an open-source AI software engineering agent platform that can write code, run commands, and perform development tasks autonomously. Exposed instances may allow unauthenticated access to the agent. !/usr/bin/env python3 -- coding: utf-8 --...

Google A2A Agent Card - Enumeration Detection

Detected exposed Google Agent-to-Agent protocol agent cards. The agent-card.json file advertises an AI agent's capabilities, supported skills, authentication requirements, and endpoint URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Google Agent-to-Agent protocol agent cards."...

Agent-Zero Application - Detect

Detected Agent-Zero AI agent framework installation. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Agent-Zero AI agent framework installation.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Agent-Zero...

aws-ecs-container-agent-tasks Detection

Aws container metadata content !/usr/bin/env python3 -- coding: utf-8 -- """Aws container metadata content.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'aws-ecs-container-agent-tasks Detection', 'description': 'Aw...

AgentGPT Panel - Detect

AgentGPT was detected. AgentGPT was a browser-based autonomous AI agent platform that allows users to create, configure and deploy AI agents directly in the browser. !/usr/bin/env python3 -- coding: utf-8 -- """AgentGPT was detected.""" from kittysploit import from lib.protocols.http.httpclient...

Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download Detection

Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/downloadworkdirfile.py, letting attackers access unauthorized files, exploit requires crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """Agent-Zero v0.""" import re from kittysploit import from...

Flowise Panel Detection

Detects Flowise LLM flow builder / AI agent panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Flowise AI agent panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Flowise Panel Detection", "description":...

Google ADK Development UI Exposure Detection

Detects the exposure of the Google Agent Development Kit ADK Development UI, which may lead to sensitive information disclosure or unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the exposure of the Google Agent Development Kit ADK Development UI, which may lead to...