EUVD-2026-42898

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace...

zero-touch-containment

zero-touch-containment Puente Antigena Darktrace → Aruba ClearPass CoA — cuarentena de usuario/dispositivo en tiempo real basada en modelos. Cero clics del SOC entre detección y contención. Implementación de referencia sanitizada de un patrón de integración NDR↔NAC operado a escala del sector...

Playbooks

Tabla de contenido TOC IR Playbooks Este repositorio contiene todos los Playbooks de Respuesta a Incidentes y los flujos de trabajo del SOC de la Compañía. Cada carpeta contiene un Playbook dividido en 6 secciones según NIST - 800.61 r2 1- Preparación Esta sección debe incluir la siguiente...

hardstop

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution Architectural Comparison: Off-Board Hardware Fabrics DPUs / SmartNICs vs. In-Cache Kernel Preemption Hard Stop Off-board hardware security architectures route agent execution telemetry out-of-band across host I/O buses...

pagecache-lpe-containment-kit

Kit de contención para LPE por caché de páginas Page-Cache Detecta, contiene y verifica defensas contra dos escaladas locales de privilegios por corrupción del caché de páginas page cache de Linux — DirtyClone CVE-2026-43503 and pedit COW CVE-2026-46331 — en hosts y contenedores. Este es un kit d...

Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay

A tool-using model can follow a malicious instruction even when its credentials are valid. We study whether task-scoped authorization contains the resulting tool execution. Our paired-replay testbed samples a model request once and submits the same action, resource, and arguments to broad bearer,...

SOC335-CVE-2024-49138-Investigation

SOC335 – CVE-2024-49138 Exploitation Investigation Overview This project documents a SOC investigation of a CVE-2024-49138 exploitation alert using the LetsDefend platform. The investigation involved analyzing network logs, researching indicators of compromise, determining whether suspicious...

CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

EUVD-2026-89537

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

Backdoor Containment Via Expert Quarantine and Shutdown in LLMs

Backdoored large language models LLMs can behave normally on benign inputs while producing attacker-specified outputs under hidden triggers. Existing defenses span four stages--prior-training, in-training, post-training, and inference-time--and share one of two underlying strategies: either...

PT-2026-103630

Name of the Vulnerable Software and Affected Versions DeepWiki-Open versions prior to commit d92819a Description An unauthenticated arbitrary file read issue exists in the 'GET /codemap/file' endpoint. By providing a non-URL value to the repo url parameter, an attacker can bypass path containment...

CVE-2026-82455

This flaw has been rejected by upstream RubyGems maintainers...

Linux Distros Unpatched Vulnerability : CVE-2026-101912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in...

CVE-2026-101912

A flaw was found in the ip-address library. This vulnerability allows a remote attacker to bypass security restrictions, such as Internet Protocol IP allowlists or denylists. The library's subnet containment checks fail to verify whether the compared addresses belong to the same address family,...

CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

UBUNTU-CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-101912

The ip-address JavaScript library for parsing and manipulating IPv4 and IPv6 addresses is vulnerable in versions prior to 10.7.1 . The isInSubnet and isHostInSubnet methods in src/common.ts fail to validate that both operands belong to the same IP family when comparing masked binary strings. This...

EUVD-2026-88396

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

OpenAI pauses work on top AI models after agent slips past internet controls

OpenAI’s latest containment failure adds to a pattern that may force the company to make an unpopular decision. The company has paused training, evaluation, and tool-enabled inference for its most capable models after an internal research agent found a way around an intended internet restriction...