EUVD-2026-121584

Server-side request forgery ssrf in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network...

CVE-2026-109485

Server-side request forgery ssrf in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network...

Malware in redeem-onchain-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Microsoft 365 Agents SDK Information Disclosure Vulnerability

Server-side request forgery ssrf in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network...

CLSA-2026-1794319329 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 0.5.0-tuxcare.1...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg\ httpdoom.console...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

CVE-2026-120013

The SAP Cloud SDK for Python contains a path traversal vulnerability in its agent_memory module. Prior to version 0.50.0 , the create_client(tenant=...) function fails to validate the tenant parameter before using it to construct filesystem paths for secret resolution. An attacker could provide a...

CVE-2026-120013 Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

The agentmemory module accepts a caller-supplied tenant parameter in createclienttenant=.... Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences for example,...

CVE-2026-120012

The SAP Cloud SDK for AI (Node.js) contains an information disclosure vulnerability where certain internal operations may include sensitive authentication credentials in error messages under specific failure conditions. An attacker with low privileges who can access application logs or forwarded ...

bucky

Bucky Bucky discovers AWS S3 buckets passively, while you browse, and checks them for misconfiguration. It has two parts: a browser addon and a backend engine. The addon watches the requests a page makes to .amazonaws.com and also scans the page markup, so it finds buckets whose URLs only ever...

pentest-mcp

Pentest MCP Pentest MCP is a TypeScript MCP server for authorized security assessments. It gives a human researcher or a tool-using assessment agent one scoped interface for discovery, validation, capture, credential checks, local audit, evidence retrieval, and report preparation. Each active too...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

mariana-trench

Mariana Trench Mariana Trench is a security focused static analysis platform targeting Android. This guide will walk you through setting up Mariana Trench on your machine and get you to find your first remote code execution vulnerability in a small sample app. These instructions are also availabl...

aws_public_ips

awspublicips Table of Contents What's it for Quick start CLI reference Configuration IAM permissions Changelog Contributing Getting in touch What's it for awspublicips is a tool to fetch all public IP addresses both IPv4/IPv6 associated with an AWS account. It can be used as a library and as a CL...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

CVE-2026-109799

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-109799 Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...