Directum Web Agent Code Execution

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

pentestcode

PentestCode AI penetration testing agent in your terminal. Multi-agent architecture • Engagement state tracking • 20+ LLM providers PentestCode is an autonomous pentesting agent for your terminal. Point it at a target and it runs the tools, reads the output, updates its picture of the network, an...

agent-scan

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...

webhandler

WebHandler A handler for PHP system functions & also an alternative 'netcat' handler Info WebHandler tries to simulate a 'Linux bash prompt' to handle and process: - PHP program execution functions e.g. system, passthru, exec, etc - Bind shell connections - Reserve shell connections Another featu...

T3MP3ST

🌩️ T3MP3ST 🌩️ ▄▄▄█████▓▓█████ ███▄ ▄███▓ ██▓███ ▓█████ ██████ ▄▄▄█████▓ ▓ ██▒ ▓▒▓█ ▀ ▓██▒▀█▀ ██▒▓██░ ██▒▓█ ▀ ▒██ ▒ ▓ ██▒ ▓▒ ▒ ▓██░ ▒░▒███ ▓██ ▓██░▓██░ ██▓▒▒███ ░ ▓██▄ ▒ ▓██░ ▒░ ░ ▓██▓ ░ ▒▓█ ▄ ▒██ ▒██ ▒██▄█▓▒ ▒▒▓█ ▄ ▒ ██▒░ ▓██▓ ░ ▒██▒ ░ ░▒████▒▒██▒ ░██▒▒██▒ ░ ░░▒████▒▒██████▒▒ ▒██▒ ░ ▒ ░░ ░░ ▒░ ░░...

EUVD-2026-104958

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...

ssh-tpm-agent

SSH agent for TPM ssh-tpm-agent is a ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module TPM for authentication towards ssh servers. TPM sealed keys are private keys created inside the Trusted Platform Module TPM and sealed in .tpm suffixed files. They are bou...

CVE-2026-14933

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...

BabyShark

INTRO This is a basic C2 generic server written in Python and Flask. This code has based ideia to GTRS, which uses Google Translator as a proxy for sending commands to the infected host. The BabyShark project aims to centralize reverse connections with agents, creating a way to centralize several...

sandbox-agent

Agents Agent infrastructure from Rivet. Join us on Discord. Projects Project| Directory| Docs ---|---|--- Rivet Agents : run agents such as Pi as durable Rivet Actors @rivet-dev/pi, @rivet-dev/sandbox-adapter| packages/, docs in docs/| rivet.dev/agents/docs Sandbox Agent : run coding agents in...

burp-ai-agent

Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...

LeitWacht Agent

leitwacht-agent https://leitwacht.eu — source of truth: https://gitlab.com/leitwacht/leitwacht-agent. Issues, MRs, and discussions live on GitLab. Pre-1.0. The 0.x series is pre-stable; minor releases may carry breaking changes to APIs, env-var names, helm values.yaml keys, and rule-file schema...

skill-scanner

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection YAML + YARA-X, AST and dataflow analysis , an optional LLM-as-a-judge , and a bounded CEL decision layer over typed...

PentestGPT

!Contributorscontributors-shieldcontributors-url !Forksforks-shieldforks-url !Stargazersstars-shieldstars-url !Issuesissues-shieldissues-url !MIT Licenselicense-shieldlicense-url !Discorddiscord-shielddiscord-url PentestGPT AI-Powered Autonomous Penetration Testing Agent Published at USENIX...

nono

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. nono is a complete agent...

SWE-agent

!warning Most of our current development effort is on mini-swe-agent, which has superseded SWE-agent. It matches the performance performance of SWE-agent, while being much simpler. See the FAQ for more details about the differences. Our general recommendation is to use mini-SWE-agent instead of...

pentest-copilot

Pentest Copilot An open-source, AI-driven penetration testing agent. Connects to a Kali attack box, runs tools autonomously, analyzes results, and iterates. You describe the target. It does the rest. Built for real-world engagements, boot2root boxes, and CTFs. In Action Pentest Copilot performing...

LeitWacht

GitLab Runner Leitwacht Network egress enforcement for GitLab Runner CI/CD containers. Leitwacht prevents supply chain attacks from exfiltrating secrets by controlling what each job container can access on the network. How It Works Leitwacht is a standalone agent that runs alongside GitLab Runner...

CVE-2026-14933 Unblu Spark Cross-Site Scripting in Embedded Co-Browsing

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...