TPMGenie

TPM Genie TPM Genie is designed to aid in vulnerability research of Trusted Platform Modules. As a serial bus interposer, TPM Genie is capable of intercepting and modifying all traffic that is sent across the I2C channel between the host machine and a discrete TPM chip. Outside of research, the...

CVE-2024-4701-POC

CVE-2024-4701-POC POC for CVE-2024-4701 Download the genie docker file from https://netflix.github.io/genie/docs/4.3.0/demo/docker-compose.yml or this repo run docker-compose up Download the attached http payload loadlib Run the following command nc -w 5 localhost 8080 loadlib You may need to...

n8n-databricks-path-join

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · n8n-databricks-path-join n8n-databricks-path-join n8n 2.42.0 - n8n GmbH GHSA-89p4-6h98-c7xm and GHSA-rqch-9jrh-cr8w introduced toPathSegment: encodeURIComponent plus reject '' / . / ... getSpace.operation.ts...

Genie Access WIP3BVAF IP Camera - Local File Inclusion

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to local file inclusion via the web interface, as demonstrated by reading /etc/shadow. id: CVE-2019-7315 info: name: Genie Access WIP3BVAF IP Camera - Local File Inclusion author: 0xAkoko severity: hi...

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Vulnerability Details File: icongenie/lib/utils/get-assets-files.js line 35, absoluteName: joinappDir, asset.folder, asset.name Validation gap: icongenie/lib/utils/validate-profile-object.js assetsSchema — folder/name only checked with Joi.string.required.min1, no restriction on .. sequences or...

AIs as Modern Genies

This essay was written with Barath Raghavan, and originally appeared inLawfare. In April, an artificial intelligence AI agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI aske...

The OpenAI Hack Shows the Genie Is Out of the Bottle

This essay originally appeared inForeign Policy. Earlier this month, two of OpenAI's models broke out of their containment sandbox and attacked another AI company. The story is kind of wild. OpenAI was running security tests on two of its models: GPT-5.6 Sol and an unreleased model that is almost...

Toy Ghouls’ new toy: the GenieLocker ransomware

Introduction The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks against organizations in the Russian Federation, primarily in the manufacturing sector, and attributed to the Toy Ghouls group by open-source intelligence link in Russian. The Toy...

Genie Access WIP3BVAF IP Camera - Local File Inclusion Detection

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to local file inclusion via the web interface, as demonstrated by reading /etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera device...

Why AI Needs a “Genie Coefficient”

This essay was written with Barath Raghavan, and originally appeared inIEEE Spectrum. Major benchmarks measure what AI can do. None measure whether it does what you mean: the distance between what you ask an AI to do and the unspoken assumptions about how you want the AI to do it. We propose a ne...

Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10141 Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @genie-auth/config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

git-genie (0.2.0), langchain-visualizer (0.0.6) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.75)

langchain PYPI version 0.0.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.2.0 - langchain-visualizer 0.0.6 - vcr-langchain 0.0.8 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

git-genie (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.71)

langchain PYPI version 0.0.71 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

git-genie (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.71)

langchain PYPI version 0.0.71 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

git-genie (0.2.0), langchain-visualizer (0.0.6) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.75)

langchain PYPI version 0.0.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.2.0 - langchain-visualizer 0.0.6 - vcr-langchain 0.0.8 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

com.github.edgar615:spring-boot-util-jwt (>=0.0.1, <=0.0.2), com.github.edgar615:spring-boot-util-web (>=0.1.0, <=0.1.3) +160 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.2.8.release)

org.springframework:spring-webmvc MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.edgar615:spring-boot-util-jwt =0.0.1, =0.1.0, =2.0, =2.0.0, =3.0.0-rc.26,...

com.github.edgar615:spring-boot-util-jwt (>=0.0.1, <=0.0.2), com.github.edgar615:spring-boot-util-web (>=0.1.0, <=0.1.3) +34 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.37)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.edgar615:spring-boot-util-jwt =0.0.1, =0.1.0, =2.0.0, =3.0.0-rc.2...

CVE-2026-30635

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the viewtask aka view in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGEBASEURL...