SOC335-CVE-2024-49138-Investigation

SOC335 – CVE-2024-49138 Exploitation Investigation Overview This project documents a SOC investigation of a CVE-2024-49138 exploitation alert using the LetsDefend platform. The investigation involved analyzing network logs, researching indicators of compromise, determining whether suspicious...

CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...

zero-touch-containment

zero-touch-containment Puente Antigena Darktrace → Aruba ClearPass CoA — cuarentena de usuario/dispositivo en tiempo real basada en modelos. Cero clics del SOC entre detección y contención. Implementación de referencia sanitizada de un patrón de integración NDR↔NAC operado a escala del sector...

EUVD-2026-89537

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

Backdoor Containment Via Expert Quarantine and Shutdown in LLMs

Backdoored large language models LLMs can behave normally on benign inputs while producing attacker-specified outputs under hidden triggers. Existing defenses span four stages--prior-training, in-training, post-training, and inference-time--and share one of two underlying strategies: either...

Playbooks

Tabla de contenido TOC IR Playbooks Este repositorio contiene todos los Playbooks de Respuesta a Incidentes y los flujos de trabajo del SOC de la Compañía. Cada carpeta contiene un Playbook dividido en 6 secciones según NIST - 800.61 r2 1- Preparación Esta sección debe incluir la siguiente...

CVE-2026-82455

This flaw has been rejected by upstream RubyGems maintainers...

Linux Distros Unpatched Vulnerability : CVE-2026-101912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in...

hardstop

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution Note on Nvidia's Open Agent Safety Platform Sept 28, 2026: Nvidia's newly announced Sentry architecture utilizes out-of-band BlueField DPUs to achieve millisecond-scale agent containment. Hard Stop provides a...

CVE-2026-101912

A flaw was found in the ip-address library. This vulnerability allows a remote attacker to bypass security restrictions, such as Internet Protocol IP allowlists or denylists. The library's subnet containment checks fail to verify whether the compared addresses belong to the same address family,...

CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

UBUNTU-CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-101912

The ip-address JavaScript library for parsing and manipulating IPv4 and IPv6 addresses is vulnerable in versions prior to 10.7.1 . The isInSubnet and isHostInSubnet methods in src/common.ts fail to validate that both operands belong to the same IP family when comparing masked binary strings. This...

EUVD-2026-88396

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

pagecache-lpe-containment-kit

Kit de contención para LPE por caché de páginas Page-Cache Detecta, contiene y verifica defensas contra dos escaladas locales de privilegios por corrupción del caché de páginas page cache de Linux — DirtyClone CVE-2026-43503 and pedit COW CVE-2026-46331 — en hosts y contenedores. Este es un kit d...

OpenAI pauses work on top AI models after agent slips past internet controls

OpenAI’s latest containment failure adds to a pattern that may force the company to make an unpopular decision. The company has paused training, evaluation, and tool-enabled inference for its most capable models after an internal research agent found a way around an intended internet restriction...

CVE-2026-101912: Incorrect Comparison

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-92812

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812

decap-server , the local server component of the decap-cms content management system, is affected by a path traversal vulnerability in its local proxy containment guard. The guard performs a plain string prefix comparison without validating path separators, allowing attackers to access sibling di...