CVE-2026-79696: Incomplete List of Disallowed Inputs

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Dark-Moon v1.4.0

DarkMoon Open-source autonomous AI penetration testing — finds, exploits and qualifies every vulnerability on your own infrastructure ⭐ Star DarkMoon · 🚀 Quick Start · 🧩 Integrations · 📊 Benchmark · 🔒 Darkmoon Pro · ▶️ Install & Run OSS · ▶️ Demo Pro DarkMoon is autonomous AI penetration testing...

vuln_apps

vulnapps 一系列故意存在漏洞的应用，用于将安全工具（crossfyre、Burp、ZAP、nuclei 等）指向目标。此文件夹不包含任何应用源码 ，只有骨架定义和一个小型管理器。每个应用都作为自己独立的容器栈运行，因此不会相互冲突。 这里的一切都是故意有漏洞的。仅供本地测试。 请勿将这些暴露到互联网或不受信任的网络。所有端口都绑定到 127.0.0.1。 工作原理 docker compose up 启动一个容器：vulnappsmanager （控制平面）。它本身不会启动任何漏洞应用。 你通过管理器来驱动整个应用集群。每个应用由 apps// 下的一个骨架文件夹（一个...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

PT-2026-86583

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test default model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base url results in server-side request forgery. The attack may be initiat...

CVE-2026-67277: Missing Authentication for Critical Function

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

WindowsProtocolTestSuites v4.26.9.0

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

Malicious Package

Overview eigenstate-test-technocracy-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Faraday 5.24.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

CVE-2026-85674: Improper Control of Generation of Code

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

PT-2026-85567

Name of the Vulnerable Software and Affected Versions aider versions 0 through 0.86.2 Description The software automatically loads a .aider.conf.yml configuration file from the root of the git repository where it is launched. An attacker can craft a repository containing a malicious configuration...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

MAL-2026-15834 Malicious code in apple-internal-test-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f166ea5f034867eae7d9bdc6f82b50c40a22b5237c6e591953d73947dd43244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-internal-test-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f166ea5f034867eae7d9bdc6f82b50c40a22b5237c6e591953d73947dd43244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-90886

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERR PTR to kthread stop In test ringbuffer's out free cleanup loop, the check !rb threadscpu only catches NULL entries and misses entries that hold an ERR PTR. rb threads is static, so unassigned...

CICD-Goat-Vapt-Writeup — Updated!

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...