7063 matches found
DEBIAN-CVE-2026-47081
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...
CVE-2026-47081
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...
FlowGuard: From Signals to Evidence for MCP Security Detection
The Model Context Protocol MCP enables LLM agents to interact with external tools through metadata exchange, tool invocation, and response consumption. Existing MCP security scanners primarily reason about suspicious semantic signals rather than real execution behaviors, which can lead to...
PT-2026-60549
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...
CVE-2026-47081
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...
MAL-2026-10678 Malicious code in ls-env-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...
Malicious code in ls-env-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...
MAL-2026-10609 Malicious code in utils-style-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...
MAL-2026-10579 Malicious code in bimi-maker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...
Malicious Package
Overview @amedit/vercel-builder-probe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in @amedit/vercel-builder-probe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe0b29ddff65cbd65167ea905c448d928fc6da661d69df415993635bf1bd3bc When wired in as a @vercel/build-utils Builder and the exported build runs in a Vercel deployment pipeline, index.js reads the installer's...
MAL-2026-10548 Malicious code in @amedit/vercel-builder-probe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe0b29ddff65cbd65167ea905c448d928fc6da661d69df415993635bf1bd3bc When wired in as a @vercel/build-utils Builder and the exported build runs in a Vercel deployment pipeline, index.js reads the installer's...
Malicious Package
Overview @gleamkit/probe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-59058
Summary Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a...
Traefik Dashboard Detection
Detects Traefik reverse-proxy dashboard and /api/overview exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Traefik dashboard and API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Traefik...
DNP3 master probe
Active DNP3 master-style probe against an outstation on TCP/20000 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3master from lib.protocols.ics.icsscannerclient import...
Auth0 Detection
Detects Auth0 tenants via OIDC metadata and hosted login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Auth0 identity platform tenants.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...
JWT / OAuth Misconfiguration Probe
Probe API surfaces for JWT alg=none, weak secrets, OAuth callback open redirects, and missing state parameter enforcement. !/usr/bin/env python3 -- coding: utf-8 -- """ JWT and OAuth/OIDC misconfiguration probe. Detects alg=none, weak HMAC secrets, expired-signature acceptance, open redirects in...
Host Header Injection Probe
Tests Host and X-Forwarded-Host manipulation for reflection in responses, redirects, and cache/password-reset style poisoning signals. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Host header and X-Forwarded-Host injection misconfigurations.""" from future import annotations import json fr...
Malicious code in dc-repro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b27530f3aa6f2f96c3aa77ffad048e51ee4479d60c81ce59687772b6985a99b On npm install, postinstall.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://130.49.177.51:18080/p/dc-20260627-yandex-geobase carrying...