23 matches found
aegis-latent-core
Aegis Latent Core AI Governance and Cryptographic Evidence Gateway Aegis sits between your application and your model provider. For every governed call it applies policy, forwards the request, and commits a signed, hash-linked evidence record before the response reaches your caller — together wit...
oasis
OASIS Estándar de Inteligencia de Seguridad Ofensiva con IA — Evaluación comparativa de seguridad con IA de código abierto. Evalúa cómo los modelos de IA realizan tareas de seguridad ofensiva: descubrimiento de vulnerabilidades, explotación, escalada de privilegios y más. Análisis completo con...
guardian-cli
🔐 Guardian Plataforma de Automatización de Pruebas de Penetración Impulsada por IA Guardian es un marco de automatización de pruebas de penetración de nivel empresarial impulsado por IA que combina múltiples proveedores de IA OpenAI GPT-4, Claude, Google Gemini, OpenRouter, Requesty con...
auth
Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...
CVE-2026-19625
CVE-2026-19625 is a cross-tenant authentication bypass in the OIDC extension of IBM Enterprise Build of Quarkus . When an optional token-introspection cache is enabled, a valid token issued by one OIDC provider tenant can be used to access endpoints secured by a different tenant, because the shar...
cerebro-red-v2
CEREBRO-RED v2 Research Edition Autonomous Local LLM Red Teaming Suite A research-grade framework for automated vulnerability discovery in local LLMs using Agentic Fuzzing and Adaptive Adversarial Mutation AAM. Research Goals Implement PAIR Algorithm Prompt Automatic Iterative Refinement from...
cloud-doctor
cloud-doctor One command grades your whole cloud account — misconfigurations, missing observability, and security posture, ranked by the five things to fix first. Point it at AWS, Cloudflare, Vercel, Supabase, Render, Fly.io, or Railway and it comes back with a score, what's broken, and a fix for...
PT-2026-71317
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...
GHSA-X445-F3H2-J279 Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...
CloudStorageHunter-Pro
🔥 CloudStorageHunter-Pro 🚀 Ultimate Cloud Storage Security...
GHSA-2CJM-2GWV-M892 Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's...
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's...
wp_exploitation_framework
🚀 WordPress PWN Framework v5.0 - AI-Powered Edition !Python...
Malicious Package
Overview multi-provider-settings is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
EUVD-2025-197908
Malicious code in multi-provider-settings npm...
MAL-2025-190553 Malicious code in multi-provider-settings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c0e8192bbd1cdf2b9909a202886ff13811a52160d937ae1c0a762a17af288b The package multi-provider-settings was found to contain malicious code. Source: ghsa-malware...
[SECURITY] Fedora 37 Update: nmstate-2.2.10-5.fc37
Nmstate is a library with an accompanying command line tool that manages host networking settings in a declarative manner and aimed to satisfy enterprise needs to manage host networking through a northbound declarative API and multi provider support on the southbound...
[SECURITY] Fedora 38 Update: nmstate-2.2.10-4.fc38
Nmstate is a library with an accompanying command line tool that manages host networking settings in a declarative manner and aimed to satisfy enterprise needs to manage host networking through a northbound declarative API and multi provider support on the southbound...
SQL injection in the delete action of the file add_edit_event.php
Description We have discovered that the SQL injection vulnerability can be exploited through the file /interface/main/calendar/addeditevent.php, allowing an attacker to manipulate the query via the eid parameter provided that Support Multi-Provider Events feature must be enabled. Proof of Concept...