596 matches found
Exploit for CVE-2026-0265
CVE-2026-0265 Passive Detector v2 Defensive reconnaissanc...
Malicious code in web3-secrets-detector (npm)
A coordinated supply-chain attack comprising 10 npm packages published by maintainer ddjidd5640 [email protected] within a 48-hour window 2026-05-19T03:55Z – 2026-05-21T04:31Z. All packages masquerade as legitimate Web3/DeFi developer security tools MCP servers while silently exfiltrating...
ADR: An Agentic Detection System for Enterprise Agentic AI Security
We present the Agentic AI Detection and Response ADR system, the first large-scale, production-proven enterprise framework for securing AI agents operating through the Model Context Protocol MCP. We identify three persistent challenges in this domain: 1 limited observability -- existing Endpoint...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: certificate-transparency, node-problem-detector, minio, k8sgpt, keda, tempo, opentelemetry-operator, mcp-grafana, jaeger, trillian, loki, mc, telegraf, cloud-sql-proxy, karma, istio, minio-operator, opentelemetry-collector-contrib, aws-otel-collector, datadog-agent,...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
DIRTYFAIL A unified detector and PoC harness for the Copy...
CVE-2026-41483
OpenTelemetry.Resources.Azure (Azure VM resource detector) suffers from unbounded HTTP response body reads in AzureVmMetaDataRequestor when contacting the Azure VM metadata endpoint, causing unbounded memory usage and potential DoS. The issue affects versions 1.15.0-beta.1 and earlier; it is fixe...
CVE-2026-41483 Unbounded HTTP response body read in OpenTelemetry.Resources.Azure
OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class makes HTTP requests to the Azure VM instance metadata service and reads the response body into memory without any size limit. An attacker w...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
CVE-2026-31431 "Copy Fail" — XCP-ng Laboratory Detector A saf...
Gray-Box Poisoning of Continuous Malware Ingestion Pipelines
Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secmlmalware framework, we generate problem-space...
Rayhunter IMSI Catcher Detector
Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts, it can support some other devices as well. It's also designed to be as easy to...
Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection
Representation Engineering typically relies on static refusal vectors derived from terminal representations. We move beyond this paradigm, demonstrating that refusal is a dynamic and sparse process rather than a localized outcome. Using Causal Tracing, we uncover the Refusal Trajectory-a persiste...
GHSA-VC24-J8C5-2VW4 OpenTelemetry.Resources.Azure has an unbounded HTTP response body read
Summary OpenTelemetry.Resources.Azure reads unbounded HTTP response bodies from the Azure VM remote instance metadata service endpoint into memory. This would allow an attacker-controlled endpoint or one acting as a Man-in-the-Middle MitM to cause excessive memory allocation and possible process...
cve_2026_31431
CVE-2026-31431 "Copy Fail" Toolkit Detector and proof-of-co...
PT-2026-37115
Name of the Vulnerable Software and Affected Versions OpenTelemetry.Resources.Azure versions prior to 1.15.0-beta.2 Description The AzureVmMetaDataRequestor function makes HTTP requests to the Azure VM instance metadata service and reads the response body into memory without a size limit. An...
net_exploit_detector
netexploitdetector.py Behavioral network exploit detector f...
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
Summary Versions of i18next-http-middleware prior to 3.9.3 wrote user-controlled language values into the Content-Language response header after passing them through utils.escape, which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013684)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013684 advisory. In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in putpagebootmem The vmemmap pages is marked by...
CVE-2026-40179 vulnerabilities
Vulnerabilities for packages: certificate-transparency, minio, tempo, keda, mcp-grafana, jaeger, trillian, loki, mc, telegraf, cloud-sql-proxy, karma, istio, minio-operator, aws-otel-collector, datadog-agent, minio-object-browser, prometheus-pushgateway, splunk-otel-collector, grafana-pyroscope...
GHSA-VFFH-X6R8-XX99 vulnerabilities
Vulnerabilities for packages: certificate-transparency, minio, tempo, keda, mcp-grafana, jaeger, trillian, loki, mc, telegraf, cloud-sql-proxy, karma, istio, minio-operator, aws-otel-collector, datadog-agent, minio-object-browser, prometheus-pushgateway, splunk-otel-collector, grafana-pyroscope...