The Harness Is the Hard Part of Agentic Pentesting

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harnes...

CVE-2026-114084

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key...

EUVD-2026-106309

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll Year End. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

PT-2026-120885

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.3.5 GitLab CE/EE versions 19.4 through 19.4.2 GitLab CE/EE versions 19.5 through 19.5.0 Description Insufficient scope enforcement on a GraphQL field allows an authenticated user possessing a read api-scop...

GitLab 18.2 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-12664)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...

SUSE CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-83391

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll Year End. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-83391

The Oracle E-Business Suite product Oracle HRMS (US) , specifically within the US Payroll Year End component, is affected by a vulnerability in versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this flaw to compromise the system, though it requires human...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712

The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...

EUVD-2026-104485

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies...

PT-2026-119828

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD...

Linux Distros Unpatched Vulnerability : CVE-2026-111749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be...

Malware in @an1mshnpmb9c84920/gat-scope-target-125ec19a

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18046 Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dc3b92004ead215cd901502c386aa4177efb1610aaa4bcba1440204380e719 Package @an1mshnpmb9c84920/[email protected] contains two files and no observable installer-harm behavior. There are no lifecycle scrip...

Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dc3b92004ead215cd901502c386aa4177efb1610aaa4bcba1440204380e719 Package @an1mshnpmb9c84920/[email protected] contains two files and no observable installer-harm behavior. There are no lifecycle scrip...

Malicious Package

Overview @an1mshnpmb9c84920/gat-scope-target-125ec19a is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

DEBIAN-CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...