PT-2026-67038

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures

Multi-agent LLM pipelines orchestrate multiple specialized language model agents into structured workflows where intermediate outputs are passed across agents to solve complex tasks. This design introduces a security gap absent in single-agent settings: once an agent accepts adversarial content, ...

xalgorix v4.5.124

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

nono v0.71.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

screenpipe app-v2.5.158

DOWNLOAD SCREENPIPE screenpipe | YC S26 Screenpipe remembers how you actually work Record your screen continuously locally and provide context to your agents Claude, Codex, Openclaw, Hermes, Runner... https://github.com/user-attachments/assets/70fe94eb-6d2a-47ca-b7c3-c8ead13a5b7f news 06/10 - we...

dugganusa-ietf — Updated!

DugganUSA — IETF Hackathon Contributions Real-world threat-intelligence contributions from DugganUSA LLC to the IETF Hackathon, offered to project champions as empirical grounding for standards work. We are a bootstrapped threat-intelligence shop. We run a public STIX 2.1 feed, an edge-blocking...

Filesystem Dropbox-like Polling Agent

Writes a Python implant that uses a shared directory as C2 dead-drop register/commands/results. Controller: listeners/filesystem/dropboxlikepolling. Requires a shared path SMB/NFS/sync — install as backdoor, not exploit payload. from kittysploit import class ModuleBackdoor: """Filesystem dead-dro...

Slack Socket Mode / Web API Polling Agent

Writes a Python implant that polls a Slack channel for commands and posts results. Controller: listeners/messaging/slacksocketmode. Requires a Slack bot token on the implant — install as backdoor, not exploit payload. from kittysploit import class ModuleBackdoor: """Slack Web API polling implant ...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5214 more potentially affected by CVE-2026-56819 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-56819 Source advisory: GHSA-93WV-JW9V-4972...

CVE-2026-55777

A flaw was found in GoAccess. A remote attacker can craft a malicious User-Agent string in an access log. The parseios function, which processes log data, incorrectly uses an attacker-controlled offset. This can lead to an out-of-bounds heap read, causing the application to crash and resulting in...

CVE-2026-54715

A flaw was found in GoAccess, a real-time web log analyzer. A remote attacker could exploit this vulnerability by providing a specially crafted User-Agent string in an access log. This improper handling by the parsebrowser function leads to a heap out-of-bounds write, a type of memory corruption...

Agent-Security-Regression-Harness v0.2.0

OWASP Agent Security Regression Harness The OWASP Agent Security Regression Harness is an open source, vendor-neutral test harness for running executable security regression scenarios against agentic applications and MCP-integrated systems. The project helps builders and defenders verify that...

SkillSpector v2.5.1

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +16938 more potentially affected by CVE-2026-64607 via org.apache.httpcomponents.client5:httpclient5 (>=5.0-alpha1, <=5.6.2)

org.apache.httpcomponents.client5:httpclient5 MAVEN version =5.0-alpha1, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =1.0.0, =3.0.0 and more...

LangAlpha v2026.07.30

A vibe investing agent harness LangAlpha is built to help interpret financial markets and support investment decisions. English ｜ 简体中文 ｜ 日本語 Getting Started • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Pin a curated news brief from the dashboard, kick off idea generation, and...

Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no...

xalgorix v4.5.123

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

pipelock v3.3.0

Pipelock Open-source AI agent firewall forVerifiable Egress Control. !pipelock...

SUSE-SU-2026:23073-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...

agent-vault-proxy v0.9.0

keys-on-the-wire Just-in-time API keys for AI agents and any other process you route through it: the caller only ever sees a placeholder. Formerlyagent-vault-proxy. The CLI is now kow; the old avp command still works this release and is removed in the next major ADR-0045. Keys on the Wire protect...