pentest-copilot

Pentest Copilot オープンソースのAI駆動型ペネトレーションテストエージェント。Kali攻撃ボックスに接続し、ツールを自律的に実行して結果を分析し、反復します。あなたはターゲットを説明するだけ。あとはすべてお任せ。 実際のエンゲージメント、boot2rootボックス、CTF向けに構築されています。 実際の動作 OWASP Juice Shopで認証バイパスを実行するPentest Copilot: YouTubeで視聴できます Star History...

CVE-2023-28354

CVE-2023-28354 Vulnerability Description A vulnerability has been identified in Opsview Monitor Agent 6.8 that allows an unauthenticated remote attacker to execute arbitrary commands. An unauthenticated attacker can exploit this vulnerability on Windows by supplying an command-line escape sequenc...

anticipator

Anticipator Runtime security for multi-agent AI systems. Anticipator detects prompt injection, credential leakage, encoding attacks, homoglyph spoofing, path traversal, and anomalous agent behavior across LangGraph pipelines — before they become incidents. No LLMs. No embeddings. No external APIs...

CVE-2014-6271-Apache-Debian

CVE-2014-6271-Apache-Debian Overview This Repo is PoC environment of CVE-2014-6271. You can deploy web service including vulernability using apache2 container image. Preparation Image Build Build insecure image from Dockerfile. docker build -t cve-2014-6271-apache-debian:buster...

The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security

LLM-agent security has produced a dense landscape of defenses - prompt hardening, content filters, permission gates, sandboxes - yet no framework tells a deployer what a defense actually guarantees, or where that guarantee comes from. We apply Verification Autonomy Levels VAL - L0: LLM...

PT-2026-104485

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Xalgorix Autonomous AI Pentesting Agent 4.6.139

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Bounded Reasoning: Cognitive Hierarchy in Human-Versus-AI Cyber Defense

Human-agent evaluations often compress interaction into a single performance score, even when human and automated policies adapt differently over time. We study this in a sequential cyber-defense game on an attack graph, where a human or reinforcement-learning defender protects cloud assets again...

gopher47

gopher47 适用于 Havoc 框架的第三方 Gopher 刺客 就像电子游戏一样 :D 这是什么？🤔 这是用 Golang 为 Havoc C2 编写的第三方 agent，主要作为一个学习项目来写，但我相信它仍然有用。 等这篇文章发布时，你可以在我的博客上了解更多关于这是什么以及为什么这么做的内容：这里 欢迎贡献！ 我不打算更新得太频繁，但如果我做得开心，未来可能会加更多东西。 命令 Command| Description| Example ---|---|--- checkin| 返回基本系统信息| checkin shell| 运行命令（通过 Go 的 os/exec 执行...

bladelogic_bmc-cve-2016-1542

bladelogicbmc-cve-2016-1542 A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net https://insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/ I recently came across systems vulnerable to this CVE in a recent penetration test and found exploits...

gha-lab-61c59f4acb

FastGPT English | 简体中文 | Bahasa Indonesia | ไทย | Tiếng Việt | 日本語 FastGPT は AI Agent 構築プラットフォームであり、すぐに使えるデータ処理やモデル呼び出し機能を提供します。また、Flow の可視化によるワークフローオーケストレーションにより、複雑なアプリケーションシナリオを実現できます！ https://github.com/labring/FastGPT/assets/15308462/7d3a38df-eb0e-4388-9250-2409bd33f6d4 クイックスタート Docker を使って...

rhuss__jolokia_CVE-2018-1000129_1-4-0

Jolokia is a fresh way to access JMX MBeans remotely. It is different from JSR-160 connectors in that it is an agent-based approach which uses JSON over HTTP for its communication in a REST-stylish way. Multiple agents are provided for different environments: WAR Agent for deployment as web...

area51

Every callback, captured. The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a dashboard you control, and it gets whatever response you choose in return. Getting started · Playbooks · CLI · Architecture ·...

GO-2026-6615 vulnerabilities

Vulnerabilities for packages: grafana-fips, grafana, elastic-agent, elastic-agent-fips...

Vlun-Agent-X

VulnAgent-X Research Prototype VulnAgent-X is a research-focused multi-agent prototype for bug and vulnerability detection. It takes a local repository or diff as input, and outputs structured findings, evidence chains, localization, confidence, and experiment logs. Core Capabilities Inputs: repo...

ephemora-cell

Ephemora Cell Ephemora Cellは、AIエージェント、MCPツール、プラグイン、およびアプリケーション内で信頼できないコードを実行するための軽量なセキュリティおよび実行プリミティブです。 Run untrusted code. Control its capabilities. Bound its resources. Record what happened. AIエージェント、MCPツール、プラグイン、コードインタプリタ、その他の信頼できないワークロード 向けに構築されています。 AI Agent / Application │ ▼ Tool / Plugin ...

CVE-2026-63077

CVE-2026-63077 — JetBrains TeamCity 未認証RCE -red.svg 重大な未認証リモートコード実行（CVSS 9.8）— 実環境で活発に悪用中 このリポジトリには、JetBrains TeamCity における重大なデシリアライゼーション脆弱性である CVE-2026-63077 に対する完全に機能する概念実証（PoC）エクスプロイトが含まれており、未認証の攻撃者がサーバー上で任意のコマンドを実行できるようにします。 このエクスプロイトは、Agent Registration...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

EUVD-2026-91773

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...