MASAPT

MASAPT 🤖 ↔ 🤖 ↔ 🤖 ❗ 면책 조항 이 도구는 대학 과정의 일환으로 학술 및 연구 목적으로 개발되었습니다. 사전 동의 없이 대상을 공격하는 데 MASAPT를 사용하는 것은 불법입니다. 개발자는 이 도구로 인한 모든 피해에 대해 책임을 지지 않으며, MASAPT의 어떤 악의적인 사용도 규탄합니다. 이 도구는 현재 전문적인 환경에서 사용하기 위한 것이 아니며, 기본이 되는 이론적 모델의 개념 증명에 불과합니다. ...에 오신 것을 환영합니다. 자동 침투 테스트를 위한 다중 에이전트 시스템 🐱‍💻 탐색 → 익스플로잇 → 보고...

CVE-Factory

CVE-Factory: 코드 보안 취약점을 위한 전문가 수준 에이전트 작업 확장 CVE-Factory는 완전 자동화된 엔드투엔드 CVE 재현을 위한 멀티 에이전트 시스템입니다. CVE 레코드가 주어지면 시스템이 자동으로 세부 정보를 조사하고, 테스트 케이스를 생성하며, Docker 환경을 구축하고, 각 취약점이 악용exploit과 패치 모두 가능한지 검증합니다. 이 파이프라인은 수동 개입 없이 CVE 메타데이터를 재현 가능하고 테스트 가능한 취약점 환경으로 변환합니다. ⚠️ 보안 경고 : 이 시스템은 취약한 소프트웨어가 포함된...

on-device-browser-agent

로컬 브라우저 - 기기 내 AI 웹 자동화 곧 메인 저장소에서 runanywhere-web-sdk 지원을 시작합니다: 확인해 보세요: https://github.com/RunanywhereAI/runanywhere-sdks WebLLM을 사용하여 AI 기반 웹 자동화를 전적으로 기기 내에서 실행하는 Chrome 확장 프로그램입니다. 클라우드 API, API 키가 필요 없으며 완전히 비공개입니다. Demo...

CVE-2026-57124

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-57132

PraisonAI is an AI multi-agent framework. Prior to 4.6.62 , setting the PRAISONAI_CALL_AUTH=disabled environment variable causes the verify_token function (in agent_invoke.py) to return immediately, unconditionally bypassing all authentication on the /api/v1/agents/{id}/invoke endpoint. Because t...

CVE-2026-55541

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...

CVE-2026-55539

PraisonAI, a multi-agent teams system, exposed its async Jobs API (/api/v1/runs) without authentication prior to version 4.6.51. The create_app function mounted the endpoint with no access control, allowing any reachable caller to submit jobs, read results, cancel runs, or delete jobs using opera...

CVE-2026-55539 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

Semantic Multi-Agent Intrusion Detection for IoT:Zero-Day and Adversarial Threats with Risk-Aware Reasoning

The rapid proliferation of Internet of Things IoT devices has enabled unprecedented automation and connectivity, but it has also substantially increased the attack surface, exposing networks to sophisticated cyber threats, including zero-day and adversarial intrusions. Traditional Intrusion...

CVE-2026-40113

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

SHIELDS: Automating OS Hardening with Iterative Multi-Agent Remediation

Security misconfigurations remain a leading cause of OS-level compromise, and manually keeping systems compliant with standards like Defense Information Systems Agency DISA Security Technical Implementation Guides STIGs is a tedious and expensive process. Existing compliance automation tools can...

TIBlender: Early-Warning Threat Intelligence from Cross-Platform Social Media Evidence

Cyber threat signals are fragmented across multiple social media platforms, yet no existing approach has fully automated their integration into actionable threat intelligence TI reports. We present TIBlender, a multi-agent system that monitors four platforms X, Reddit, Telegram, and Discord and...

FORGE: Multi-Agent Graduated Exploitation and Detection Engineering

Vulnerability disclosure volumes now far exceed organizational assessment capacity, yet three adjacent research communities proof-of-concept generation, vulnerability prioritization, and detection rule engineering operate largely in isolation. Existing automated exploit generation systems report...

CVE-2026-44335

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32...

CVE-2026-40149

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, a...

CVE-2026-40148

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the safeextractall function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractal...

CVE-2026-40114

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An...

MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Library

Network Intrusion Detection Systems NIDS face important limitations. Signature-based methods are effective for known attack patterns, but they struggle to detect zero-day attacks and often miss modified variants of previously known attacks, while many machine learning approaches offer limited...