DEBIAN-CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

test

test Reproducción de CVE-2018-17456...

PYSEC-2026-3861 LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots of searching and testing. EDITED TO ADD 9/14: I'm not sure if this result is correct. The blog comments have more discussion...

EUVD-2026-74768

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

CVE-2026-79696

Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installed—on Python (OSS), Cloud Run, and GKE—an unauthenticated ...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to a lack of capability and nonce checks on specific A/B testing actions. This security flaw allows any authenticated user, including those with low-level permissions like a subscriber , to overwrite the cookie banner...

Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

MAL-2026-16062 Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

CVE-2026-79696: Incomplete List of Disallowed Inputs

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Dark-Moon v1.4.0

DarkMoon Open-source autonomous AI penetration testing — finds, exploits and qualifies every vulnerability on your own infrastructure ⭐ Star DarkMoon · 🚀 Quick Start · 🧩 Integrations · 📊 Benchmark · 🔒 Darkmoon Pro · ▶️ Install & Run OSS · ▶️ Demo Pro DarkMoon is autonomous AI penetration testing...

vuln_apps

vulnapps 一系列故意存在漏洞的应用，用于将安全工具（crossfyre、Burp、ZAP、nuclei 等）指向目标。此文件夹不包含任何应用源码 ，只有骨架定义和一个小型管理器。每个应用都作为自己独立的容器栈运行，因此不会相互冲突。 这里的一切都是故意有漏洞的。仅供本地测试。 请勿将这些暴露到互联网或不受信任的网络。所有端口都绑定到 127.0.0.1。 工作原理 docker compose up 启动一个容器：vulnappsmanager （控制平面）。它本身不会启动任何漏洞应用。 你通过管理器来驱动整个应用集群。每个应用由 apps// 下的一个骨架文件夹（一个...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

PT-2026-86583

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test default model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base url results in server-side request forgery. The attack may be initiat...

CVE-2026-67277: Missing Authentication for Critical Function

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...