GHSA-C23Q-FW86-9H5X LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

MAL-2026-16095 Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

sentrymcp

sentrymcp 一个针对 MCP（模型上下文协议）服务器的静态 + 运行时安全扫描器。2026 年 1 月至 4 月期间，安全研究人员披露了 40 多个影响 MCP 服务器实现的 CVE；2026 年 Endor Labs 对公共 MCP 服务器的扫描发现，82% 至少存在一种 OWASP MCP Top 10 风险类别，67% 暴露了路径遍历或注入形态的汇聚点（sink），34% 存在硬编码或过度授权的凭据处理——另有研究显示，约 38-40% 被扫描的服务器完全没有启用任何认证。 安装 Docker： root@kitploit: docker build -t sentrymc...

Malicious code in gmgn-trading-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...

MAL-2026-16094 Malicious code in gmgn-trading-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...

Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

MAL-2026-16097 Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

MAL-2026-16096 Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

THM-Tempest

TryHackMe — Tempest SOC 一级路径 | 事件响应调查 概述 对一台受攻击的 Windows 机器进行的完整事件响应调查。攻击者通过恶意 Word 文档利用 CVE-2022-30190（Follina）获得初始访问权限，建立持久化，使用 Chisel 穿透网络，通过 PrintSpoofer 提升权限，并利用持久化恶意服务创建后门账户。 时间范围： 2022 年 6 月 20–21 日 工具： EvtxEcmd、Timeline Explorer、Wireshark、Brim、Sysmon 受害主机： TEMPEST | 用户： benimaru 攻击链摘要 | 阶...

Passkey-themed social engineering leads to identity and cloud compromise

In this article 1. Attack chain overview 2. Attribution 3. Mitigation and protection guidance 4. Learn more Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods,...

firmware-analysis-toolkit v2.0.0-alpha.1

FAT — Firmware Analysis Toolkit Firmware Analysis Toolkit is a security research toolkit for investigating firmware security for IoT, Physical AI, Mobile Devices & Robotics. It is primarily built for the "Offensive IoT Exploitation" training conducted by Attify. It has been built based on actual...

zero-touch-containment

zero-touch-containment Antigena Darktrace → Aruba ClearPass CoA ブリッジ — モデル駆動型、リアルタイムのユーザー/デバイス隔離。検出から封じ込めまで、SOCのクリックは不要。 実運用のNDR↔NAC統合パターンを参考にした、サニタイズされたリファレンス実装。金融機関規模（数千エンドポイント、24時間365日稼働のSOC）で運用されました。顧客固有の部分は合成フィクスチャに置き換えられていますが、アーキテクチャ、意思決定フロー、運用パターンは本物です。 これが存在する理由...

LLM-MCP-Security-Field-Guide

🛡️ AI 安全领域指南 — LLM + MCP 安全 面向 LLM 应用和模型上下文协议（MCP）部署的最全面、最新、以实践者为中心的安全参考。 涵盖真实 CVE、实时攻击模式、OWASP 框架、红队工具和可操作检查清单 — 每周更新。 为何需要本指南 AI 安全格局在 2025–2026 年间发生了剧变： 🔴 492 个 MCP 服务器 公开暴露且无身份认证（Trend Micro，2026） 🔴 CVE-2025-6514 通过 mcp-remote OAuth 代理危及 437,000+ 个开发者环境 🔴 在 ClawHub 代理注册表中确认了 1,184 个恶意技能 （Antiy...

USN-8716-2 ffmpeg vulnerabilities

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides the corresponding fix for Ubuntu 26.04 LTS. Original advisory details: It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue t...

USN-8716-2: FFmpeg vulnerabilities

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides the corresponding fix for Ubuntu 26.04 LTS. Original advisory details: It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue t...