Intelligence Digest
github安全推送
GitHub 安全开源项目与漏洞监控情报推送
来自 GitHub Issues、仓库检索和关键词命中的 CVE / RCE / POC 动态。
madfxr/xss2shell-poc
XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638) | topics: poc, proof-of-concept, whitebox-penetration-testing, wordpress, xss2shell | language: Python
licitrasimone/CVE-2026-92122-poc
PoC for CVE-2026-92122: RCE using Jenkins Script Security sandbox bypass involving the Groovy Sandbox dependency. | language: Python
magicXC7/CVE-2026-94083-RCE
language: Python
murrez/HP-HPLIP-Mass-CVE-checker-2026-09
Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates | topics: cve-2026-91097, cve-2026-91098, cve-2026-91099, cve-2026-91100, cve-2026-91101, cve-2026-91102, ...
MKE84/neo8-ghostlock-adaptation
iQOO Neo8 (PD2301, 5.10.246 GKI) CVE-2026-43499 GhostLock 适配 · 48 宏 target.h + offsets.json + 15 轮实测 log · 只缺 write layer | topics: cve-2026-43499, futex-uaf, ghostlock, iqoo-neo8, pd2301, preload, vivo-root | language: ...
MKE84/allroot-neo8
iQOO Neo8 (PD2301, 5.10.246 GKI) CVE-2026-43499 / GhostLock temp-root adaptation: transport works to pselect route done; R11 write-layer pending. All 48 kallsyms targets verified. | topics: 5-10-gki-gki, android-exploit,...
yasouxken/cve-2026-41940-PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session fi...
pervinzahidli/CVE-2026-88997
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
muradislamzada/CVE-2026-93528
Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).
Malwation/CVE-2026-43786
Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that allows an application to gain root privileges. | language: C
优先展示中文安全团队维护的开源项目，兼顾工具落地场景和最近更新时间。
buzhimingdeaikun/blueteam-triage-agent
基于 LangChain tool-calling 的重保蓝队安全研判 Agent。将攻击日志、主机安全、威胁情报、主机监控、防火墙封禁五类能力封装为 StructuredTool 供模型编排，以「规则初判 + 模型表达」双通道交付"事实层—研判层—处置层"三层结构化结论；封禁等写操作纳入人在回路与审计；对提示词注入做输入/输出双侧防御。 | language: Python | stars: 0 | forks: 0 | update...
Qithird/cyberstrike-extensions
CyberStrikeAI 低耦合扩展系统 - 包含 Git 安全工具集 | language: Python | stars: 0 | forks: 0 | updated 2026-09-21T01:16:21Z | pushed 2026-09-21T01:16:17Z
Leonardl27/china-model
Pettis-Setser China economic model: shadow reserves, structural imbalance, current account forensics, FX intervention detection | language: Python | stars: 0 | forks: 0 | updated 2026-09-21T15:02:45Z | pushed 2026-09-21T...
KaGty1/AITTAK
AITTAK 是一个特制的红队AI中转站平台，部署在客户端与 AI API 上游之间，用于记录请求行为、通过监控用户Prompt及工具调用结果检测敏感信息泄露、以及通过在SSE注入工具调用实现任意命令执行。 | language: TypeScript | stars: 49 | forks: 3 | updated 2026-09-19T05:08:37Z | pushed 2026-09-19T05:08:32Z
liuyejinghong/game-design-review
游戏策划视角的试玩评审 skill：四把尺子 / 阶段校准(文字期→像素期) / 红队模式。Game design review skill for AI agents. | language: Python | stars: 0 | forks: 0 | updated 2026-09-20T03:56:59Z | pushed 2026-09-20T03:56:54Z
huxiaoyaoOh/tanhai
基于 Go 标准库的高并发 HTTP 存活探测工具，专为护网红队场景设计，零依赖、单文件、跨平台 | language: Go | stars: 1 | forks: 0 | updated 2026-09-20T07:30:50Z | pushed 2026-09-17T09:30:03Z
Fishsb/dsh-plugin-roundtable
圆桌会议 RoundTable — DeepSeek Harness (DSH) 插件：把一次会话变成可视化、可辩论、可拍板的专家圆桌会议；含三种协作模式、调度面、红队评审与 28 席专家团 | 需 DSH 0.1.5-rc.1+ · MIT License | topics: adversarial-review, agent-orchestration, cordis, deepseek, deepseek-harness, dsh...
jenn619/AiSecurityScan
AI 火起来之后，MCP 服务、Agent 技能包、第三方依赖这些“模型周围”的东西基本没人管，装进来权限不小，但传统 SAST/SCA 扫不到这块。所以把常见攻击面整理成五个域——基础设施、MCP、技能供应链、Agent 黑盒红队、模型护栏越狱。技术上用规则加 AST 语义分析，覆盖别名调用、混淆、污点传播这些正则容易漏的情况，可选叠一层 LLM 做语义复核。红队用蜜标判断上下文隔离是否失效，护栏那边直接算攻击成功率。工具本身不执行被...
ctkqiang/BurpSuiteRemote
红队远程控制平台 | Red Team Remote Control Framework 一个 Burp Suite 扩展 + Android 应用，把代理历史、拦截决策、Repeater 条目实时搬到你的手机屏幕 | topics: android, application, bugbounty, bugbounty-tool, burpsuite, china, chinese, ctkqiang, remote | languag...
savantcat/kb-embodied-agent
企业知识库具身客服：数字人员工 + 企业私有知识库 RAG + MCP 工具调用 + GB/T 47746—2026 合规自查与红队回归（上海开源软件应用创新大赛参赛作品，Apache-2.0） | topics: compliance, digital-human, embodied-agent, enterprise-knowledge-base, fastapi, gb-standard, mcp, rag | language:...