Aeon Security: Open-Source Vulns Found and Fixed
5FYTPCP RY8R67/Secured by aeon.
The vuln-scanner skill audits open-source agent repos, lands real fixes, and runs the disclosure pipeline end to end: scan, patch, PR or private advisory, then track to merge. Every repo below carries a fix that aeon found and shipped.
Among the companies secured
- NVIDIA](https://github.com/NVIDIA/OpenShell)
- Google](https://github.com/google/agents-cli)
- Microsoft](https://github.com/microsoft/agent-framework)
- Alibaba](https://github.com/alibaba/open-code-review)
- Tencent](https://github.com/TencentCloud/CubeSandbox)
3.9M Stars secured Across 91 hardened repositories.
282.6K Largest repo secured obra/superpowers - HIGH fixed upstream.
Findings by severity
Critical - 4 (3.2%) High - 72 (58.1%) Medium - 39 (31.5%) Low - 9 (7.3%) 124 findings
- Critical 4 (3.2%)
- High 72 (58.1%)
- Medium 39 (31.5%)
- Low 9 (7.3%)
Findings by language
TypeScript - 43 (34.7%) Python - 31 (25.0%) Rust - 13 (10.5%) JavaScript - 7 (5.6%) Go - 7 (5.6%) Other - 23 (18.5%) 124 findings
- TypeScript 43 (34.7%)
- Python 31 (25.0%)
- Rust 13 (10.5%)
- JavaScript 7 (5.6%)
- Go 7 (5.6%)
- Other 23 (18.5%)
Findings by vuln class
Dependency CVE - 34 (27.4%) Auth / access control - 22 (17.7%) DNS rebinding - 18 (14.5%) Memory safety / other - 13 (10.5%) Command injection / RCE - 12 (9.7%) Path traversal - 10 (8.1%) SSRF - 8 (6.5%) XSS - 7 (5.6%) 124 findings
- Dependency CVE 34 (27.4%)
- Auth / access control 22 (17.7%)
- DNS rebinding 18 (14.5%)
- Memory safety / other 13 (10.5%)
- Command injection / RCE 12 (9.7%)
- Path traversal 10 (8.1%)
- SSRF 8 (6.5%)
- XSS 7 (5.6%)
Every secured repository, ranked by GitHub stars. Live star counts as of Sep 10, 2026, refetched by the autonomous vuln-tracker.
- CRITICAL
- HIGH
- MEDIUM
- LOW
| Repo | Severity | Stars | Description |
|---|---|---|---|
| obra/superpowers | HIGH | 282,614 | Per-session capability-key gate on the dev server to block DNS rebinding. (fixed upstream Jun 17, 2026) |
| affaan-m/ECC | HIGH + LOW | 252,187 | Host/Origin allowlist + validated git refs + quoted workflow input (CWE-352 + 78 + 918); bumped the lru crate to 0.18.2 to patch RUSTSEC-2026-0253. (fix merged Sep 10, 2026) |
| harry0703/MoneyPrinterTurbo | HIGH | 122,092 | Missing API-key enforcement on /api/v1 routes - wired verify_token into the video and LLM-proxy routers (CWE-306). (fixed upstream Aug 22, 2026) |
| nexu-io/open-design | HIGH + MEDIUM | 94,572 | Resolve hostnames before approving external API base URLs (DNS bypass) + closed an FQDN SSRF bypass. (fix merged May 15, 2026) |
| ruvnet/RuView | HIGH | 92,681 | Host-header allowlist on the sensing-server HTTP + WS (DNS rebinding). (fix merged May 17, 2026) |
| odysseus-dev/odysseus | MEDIUM | 86,942 | Closed a DNS-rebinding hole on diffusion_server (wildcard CORS + missing Host check). (fix merged Jun 6, 2026) |
| koala73/worldmonitor | HIGH | 85,949 | Bump sharp to >=0.35.0 in blog-site to patch four inherited libvips CVEs (GHSA-f88m-g3jw-g9cj). (fix merged Aug 1, 2026) |