Nightingale

Nightingale：渗透测试者的 Docker 工具包 该项目由以下机构支持： | ---|--- Nightingale 是一个即用型、多架构的 Docker 工具包，专为渗透测试和安全研究而设计。 它为你提供了一个可复现的环境，包含针对 Web、网络、移动端、API、OSINT 和取证工作流的精选工具。 快速入门（2 分钟） root@kitploit: docker pull ghcr.io/rajanagori/nightingale:stable docker run -it --name Nightingale -p 8080:7681 ...

nightingale

开源监控告警管理专家 English | 中文 夜莺是什么 夜莺 Nightingale 是一款开源云原生监控告警工具，是中国计算机学会接受捐赠并托管的第一个开源项目，在 GitHub 上有超过 12000 颗星，广受关注和使用。夜莺的统一告警引擎，可以对接 Prometheus、Elasticsearch、ClickHouse、Loki、MySQL 等多种数据源，提供全面的告警判定、丰富的事件处理和灵活的告警分发及通知能力。 夜莺侧重于监控告警，类似于 Grafana 的数据源集成方式，夜莺也是对接多种既有的数据源，不过 Grafana...

CVE-2026-85692

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692 Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692

Nightingale (n9e) contains an SSRF guard bypass in the isPublicIP function within aiagent/tools/http.go, the SSRF protection for the http_fetch AI-agent tool. The function only unwraps standard IPv4-mapped (::ffff:a.b.c.d) IPv6 addresses before checking them against a forbidden-range list, failin...

EUVD-2026-71141

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692 Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the POST /api/n9e/datasource/list route, which lacks proper authorization checks. An attacker can obtain sensitive credentials, such as database passwords, HTTP bearer tokens, and mTLS client keys, by sending...

CVE-2026-58167

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

CVE-2026-58167

Nightingale (n9e) prior to 9.0.0-beta.2 exposes full datasource configurations (plaintext DB passwords, HTTP Bearer tokens, HTTP Basic passwords, and mTLS keys) via POST /api/n9e/datasource/list to any authenticated low-privilege user. The route lacks an admin gate and the DatasourceFilter does n...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

Malicious code in annual_nightingale_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f38759cab2230b3d7234206e9e3e2528fc1a566e7a09bb58309bf52e9b0dc5d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-99257

Malicious code in equivalentnightingalez3n npm...

EUVD-2025-101606

Malicious code in torynightingalez3n npm...

EUVD-2025-98456

Malicious code in gorgeousnightingalez3n npm...

EUVD-2025-102465

Malicious code in rivalnightingalez3n npm...

EUVD-2025-105919

Malicious code in devotednightingalez3n npm...

Malicious code in okay_nightingale_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81efedfbe822520db1c665334805d3d588e6978cc7f7c5cb06fe0dc6570b871f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...