366 matches found
ship-safe
面向 AI 编写软件的独立安全代理。它发现问题、调查问题是否真实存在，并向你展示证据。 网站 · 文档 · 安全与数据流 · 基准测试 · 定价 · 博客 · 贡献 Ship Safe CLI Ship Safe 在你的仓库中本地运行，分为两个层次。 一个确定性引擎 会在应用代码、AI 代理、MCP 配置、提示词、依赖项、CI/CD、密钥以及云相关配置中发现问题。快速、可重复且经过基准测试——这就是传感器层。 随后，一个调查层 会判定这些发现的价值。它会追踪到达 sink...
Software-Component-Verification-Standard
OWASP 软件组件验证标准 软件组件验证标准（SCVS）是一项由社区驱动的努力，旨在建立一个用于识别活动、控制措施和最佳实践的框架，以帮助识别并降低软件供应链中的风险。 管理软件供应链中的风险对于减少易受攻击系统的暴露面，以及将技术债务作为修复障碍进行评估非常重要。 衡量和改进软件供应链保障对于成功至关重要。具有供应链可见性的组织更有能力保护其品牌、增强信任、缩短上市时间，并在发生供应链事件时管理成本。 软件供应链涉及： 技术 人员 流程 机构 以及其他变量 提高供应链保障的门槛需要风险管理人、任务负责人以及法律和采购等业务部门的积极参与，这些部门传统上并未参与技术实施。...
boa-detector
boa-detector 这个 Zeek 包检测 HTTP 头中的 Boa web server 字符串。所有 Boa 版本均被视为存在漏洞： https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ 当观察到 /^Boa/./ 服务器字符串时，此包会针对连接的 c$id$resph 发出一个通知 BoaDetector::VulnerableBoaWebServer。...
EUVD-2026-74017
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-55273
CVE-2026-55273 is a vulnerability in Android , specifically in the AppendCommentLine function of AnnotationProcessor.cpp . The root cause is improper input validation , described as a possible supply chain risk, which can lead to local escalation of privilege with only low privileges required and...
ASB-A-524767048
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
OpenClaw went viral. Meet the maintainers building and securing it.
What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 202...
GO-2026-5381 vulnerabilities
Vulnerabilities for packages: telegraf, grafana, aws-otel-collector, k8sgpt, splunk-otel-collector, keda, cloud-sql-proxy, datadog-agent, opentelemetry-collector, karma, metrics-server, minio, trillian, node-problem-detector, amazon-cloudwatch-agent-operator, certificate-transparency,...
MAL-2026-12032 Malicious code in add-two-numbers-x7q9m (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...
@robit/oaai (>=0.1.0, <=0.2.0), hdra-ai (>=0.1.0, <=0.2.0) +2 more potentially affected by unknown CVE via open-agents-ai (0.187.596)
open-agents-ai NPM version 0.187.596 is affected by a known vulnerability. The following packages have a transitive dependency on open-agents-ai and may be impacted: - @robit/oaai =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENAGENTSAI-18550671...
@0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1), @aayshian/n8n-aisensy-ay19 (0.0.1) +112 more potentially affected by CVE-2026-65594 via @n8n/client-oauth2 (>=1.0.0, <=1.11.1)
@n8n/client-oauth2 NPM version =1.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.3.6, =0.1.0, =1.0.0, =0.1.4, =1.1.3, =1.1.6 and more Source cves: CVE-2026-65594 Source advisory: SNYK:JS-N8NCLIENTOAUTH2-18322332...
CVE-2026-44359
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...
Linux Distros Unpatched Vulnerability : CVE-2026-44359
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered ...
CVE-2026-44359
The CVE describes a flaw in Meshtastic’s GitHub workflow (main_matrix.yml) prior to version 2.7.21.1370b23 where pull_request_target could trigger jobs that check out attacker forks and execute attacker-controlled files with repository secrets and elevated GITHUB_TOKEN permissions. External PRs w...
PT-2026-61516
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main matrix.yml workflow is triggered by pull request target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevate...
GHSA-RJWR-M7QX-3FJR oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...
@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-62218 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-62218 Source advisory: SNYK:JS-OPENCLAW-18017833...
@whalent/agent (0.3.243) potentially affected by unknown CVE via @whalent/agent-core (0.3.243)
@whalent/agent-core NPM version 0.3.243 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.243 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...
PYSEC-2026-2918 PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent proces...