2905 matches found
xmap
XMap: The Internet Scanner XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning. XMap is reimplemented and improved thoroughly from ZMap and is fully compatible with ZMap, armed with the "5 minutes" probing speed and novel scanning techniques...
cicd-goat
Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...
bearer
扫描您的源代码，针对顶级安全 和隐私 风险。 Bearer 是一款静态应用安全测试（SAST）工具，旨在扫描您的源代码并分析数据流，以识别、过滤和优先处理安全与隐私风险。 Bearer 提供免费开源解决方案 Bearer CLI，以及商业解决方案 Bearer Pro，可通过 Cycode 获取。 开始 - 常见问题 - 文档 - 报告 Bug !GitHub Releaserelease-imgrelease !Testtest-imgtest 语言支持 Bearer CLI（开源） ：Go • Java • JavaScript • TypeScript • PHP •...
packj
Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...
reposherlock
RepoSherlock 英文 | Türkçe 输入GitHub仓库URL或本地路径，获取架构、运行指南、风险和可操作的问题。 实时CLI预览 为什么选择RepoSherlock 在运行前：了解架构。 在信任前：查看安全和许可证风险。 在浪费时间前：从验证过的命令开始。 它的独特之处 RepoSherlock不仅仅猜测命令。通过--try-run，它会在沙箱中尝试安装/测试/构建/启动步骤，并在运行报告中记录证据（信号、超时和备注）。 它能做什么 RepoSherlock分析一个公开的GitHub仓库或本地项目路径，并将报告包写入以下目录： .reposherlock/output//...
Astra Linux – Vulnerability in edk2
The example of an encrypted private key in EDK2, present in the IpSecDxe.efi, may pose potential security risks...
CVE-2026-21762
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting...
Agentic AI: The Weapon That No Longer Needs a Warrior
Every weapon begins as an extension of the hand that holds it. The spear lengthened the reach of the arm. The bow sent the point flying without the throw. The rifle placed a man's death a quarter mile beyond his sight, and the aircraft carried that death across oceans. At each turn, the distance...
Description-Code Inconsistency in Real-World MCP Servers: Measurement, Detection, and Security Implications
The Model Context Protocol MCP has emerged as a critical standard empowering Large Language Models LLMs to utilize external tools. In this ecosystem, LLMs rely on natural language descriptions provided by MCP servers to select and execute functions. This interaction implicitly assumes that tool...
Security, Privacy, and Ethical Risks in OpenClaw
This paper systematically investigates the security, privacy, and ethical risks, as well as the traceability challenges of OpenClaw, a locally executable AI agent system for natural language interaction and real-world task completion. While OpenClaw shows strong potential for personal assistance,...
Security of LLM-Generated Code: A Comparative Analysis
The majority of software developers use or are planning to use Artificial Intelligence AI tools in their development processes. Their top reasons include improving productivity and faster learning. In fact, Large Language Model LLM-generated code is currently in production, including in major tec...
From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI
Generative AI systems are increasingly used not only to produce content but also to retrieve data, invoke tools, and execute actions. This work examines the security and safety implications of that shift across content-level, model-level, and agentic threats. We analyze how attacker access...
CVE-2025-62316
Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2025-62316 from the linked sources; no affected products, vectors, or remediation are stated.
How AI Hallucinations Are Creating Real Security Risks
AI hallucinations are introducing serious security risks into critical infrastructure decision-making by exploiting human trust through highly confident yet incorrect outputs. When an AI model lacks certainty, it doesn’t have a mechanism to recognize that. Instead, it generates the most probable...
Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments
Tool-enabled AI agents are increasingly deployed in cloud-hosted environments and offered as services, where they perform side-effecting operations through privileged tools within execution environments. While such agents enable powerful automation, the security implications of hosting autonomous...
Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows
GitHub Continuous Integration CI workflows increasingly integrate Large Language Models LLMs to automate review, triage, content generation, and repository maintenance. This creates a new attack surface: externally controllable workflow inputs can shape LLM prompts and outputs, which may in turn...
A week in security (April 27 – May 3)
Last week on Malwarebytes Labs: 3 easy-to-miss cybersecurity risks for small businesses Actively exploited cPanel bug exposes millions of websites to takeover More PayPal emails hijacked to deliver tech support scams Hackers stole hundreds of thousands of Roblox accounts: Here’s what to do...
Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw As a Case Study
Autonomous agent frameworks built upon large language models LLMs are evolving into complex, tool-integrated, and continuously operating systems, introducing security risks beyond traditional prompt-level vulnerabilities. As this paradigm is still at an early stage of development, a timely and...
