wazuh

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

fim-ebpf

FIM-eBPF：基于 eBPF 的文件完整性监控 一个轻量级的 eBPF 程序，用于监控 Linux 上的文件创建和修改事件。该工具利用 eBPF（扩展的伯克利数据包过滤器）直接从内核跟踪文件操作，以极低的开销提供高性能监控。 特性 内核级监控 ：直接从内核跟踪文件操作（touch、nano 等）。 CO-RE 支持 ：设计用于在支持 CO-RE 的内核（内核 5.x+）上实现“一次编译，到处运行”。 可配置过滤 ：通过简单的 YAML 配置，按文件路径、操作或用户过滤事件。 目录监控 ：支持递归监控整个目录。在受监控目录（例如 /tmp）中访问的任何文件都会被跟踪。 低噪音...

asclepius

Asclepius Asclepius 通过恢复文件并主动测试其可恢复性来验证备份的完整性。它不依赖元数据，而是尝试解析真实的文件格式（文档、图像、视频、归档、电子邮件），以确认备份确实可读且可安全使用。 安装 root@kitploit: git clone https://github.com/matank001/asclepius cd asclepius uv sync 附加依赖 FFmpeg（用于视频验证） root@kitploit: macOS brew install ffmpeg Ubuntu/Debian sudo apt install ffmpeg Arch...

tarian

Tarian 通过预先注册受信任的进程和受信任的文件签名，保护运行在 Kubernetes 上的应用程序免受恶意攻击。Tarian 会检测未知进程和对已注册文件的更改，然后发送告警并采取自动化操作。保护您的 K8s 环境免受勒索软件侵害！ 我们希望将此项目作为开源项目维护，以对抗针对我们最喜爱的 Kubernetes 生态系统的攻击。通过持续贡献，我们可以作为社区共同应对威胁。 Tarian 是如何工作的？ Tarian 集群代理运行在 Kubernetes 集群中，检测未知进程和对文件的未知更改，将其报告给 Tarian 服务器，并可选择采取操作：删除违规的 Pod。它使用 eBPF...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Laboratorio de LPE en el Kernel de Linux Descripción general Este repositorio documenta una investigación completa de laboratorio sobre CVE-2026-31431 Copy Fail , una vulnerabilidad de escalada de privilegios local LPE de alta severidad en el módulo criptográfico...

cve_2023_38831_scanner

CVE-2023-38831 扫描器 概述 CVE-2023-38831 扫描器是一款先进的网络安全工具，旨在检测和分析 WinRAR 安装中是否存在 CVE-2023-38831 漏洞。该项目实现了多层次的漏洞检测方法，包括文件完整性检查、进程内存扫描、网络流量分析和沙箱执行。 功能特性 漏洞检测 ：扫描 WinRAR 安装以检测 CVE-2023-38831 漏洞。 文件完整性检查 ：验证 WinRAR 可执行文件的完整性。 进程内存扫描 ：分析正在运行的 WinRAR 进程的内存，查找可疑模式。 网络流量分析 ：监控网络流量以发现潜在的利用尝试。 沙箱执行...

Sentora

Sentora Community Edition Self-hosted security stack for small/mid teams that don't have a dedicated SOC. Drop an agent on each endpoint, point them at the server, and you get SIEM logs, file integrity, package vulnerabilities, an OpenSearch-powered log explorer, autonomous AI triage and a SOAR...

GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

Security Bulletin: Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

Summary Langflow contains two authenticated vulnerabilities that allow an attacker to write or delete arbitrary files on the server filesystem accessible to the Langflow process identity. The SaveToFileComponent constructs file paths directly from the attacker-controlled file name field supplied...

Wazuh Server 4.6.0 < 4.14.6 SQL Injection (CVE-2026-49392)

The version of Wazuh Server on the remote host is at least 4.6.0 and prior to 4.14.6. It is, therefore, affected by a SQL injection vulnerability: - DB::getFile and DB::searchFile concatenate a monitored file path into SQLite row filters without proper escaping on non-Windows systems. A local use...

CVE-2026-74596

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

EUVD-2026-64533

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

PYSEC-2026-3729

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

PYSEC-2026-3729

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

CVE-2026-63310

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-63310

Removed by vendor...

PT-2026-79561

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.3 Description The downloader module fails to verify file integrity after downloading packages and before extraction. This allows attackers to use man-in-the-middle attacks or DNS poisoning to inject malicious package...

CVE-2026-49392

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

EUVD-2026-62577

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

CVE-2026-49392 Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...