ESP32Marauder v1.14.0

ESP32 Marauder A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32 Getting Started Download the latest release of the firmware. Check out the project wiki for a full overview of the ESP32 Marauder For Sale Now You can buy the ESP32 Marauder using this link Read more...

agent-bom v0.98.2

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. 15 package ecosystems · 16 compliance surfaces · 77 MCP tools · no account required Quick start · Live demo · Docs What it is agent-bom scans repositories, images, and cloud accounts, then correlates what i...

CVE-2026-65698

A flaw was found in Void through 1.3.4 in the AI agent file-reading tools readfile, lsdir, getdirtree, and search. Those tools do not confine paths to the open workspace and can accept absolute paths or file:// URIs, including bypassing the approval gate. An attacker who can inject instructions...

pentest-confirm-mcp

pentest-confirm-mcp Model Context Protocol MCP server for...

CVE-64600-Refluxfs-POC

RefluXFS CVE-64600 PoC This repo contains a PoC of the rec...

Linux Distros Unpatched Vulnerability : CVE-2026-65698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host file...

Malicious Package

Overview @andes-tools/colors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @adobesign/as-dev-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: sqlite: lemon-3.53.4-0.1.hum1 aarch64, x8664 sqlite-3.53.4-0.1.hum1 aarch64, x8664 sqlite-analyzer-3.53.4-0.1.hum1 aarch64, x8664 sqlite-debug-3.53.4-0.1.hum1 aarch64, x8664...

MGASA-2026-0297 Updated vorbis-tools package fixes a security vulnerability

The updated package fixes a security vulnerability: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input,...

Updated vorbis-tools package fixes a security vulnerability

The updated package fixes a security vulnerability: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input,...

NullsecMultitools

nullsec A menu-driven offensive-security multitool — 37 mod...

JLSEC-2026-793 Hugo's Node tool execution allows file system access outside the project directory

Impact When building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write...

openSUSE 16 Security Update : net-tools (openSUSE-SU-2026:21429-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21429-1 advisory. This update for net-tools fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted...

SUSE SLED15 / SLES15 Security Update : net-tools (SUSE-SU-2026:3223-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3223-1 advisory. - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted the preceding...

SUSE SLES12 Security Update : net-tools (SUSE-SU-2026:3222-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3222-1 advisory. - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted the preceding description block directly from the...

EUVD-2026-42616

Open WebUI: Stored web worker XSS via Pyodide...

CVE-2026-66005

CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

Authentication Bypass

LiteLLM is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the MCP authentication fallback path, where failed LiteLLM key validation is replaced with an empty authentication object, which allows an unauthenticated attacker to exploit the MCP Streamable HTTP...