shouganaiyo-loader

shouganaiyo-loader: Forced Entry for Java Agents shouganaiyo-loader is a cross-platform Frida-based Node.js command-line tool that forces Java processes to load a Java/JVMTI agent regardless of whether or not the JVM has disabled the agent attach API. Install $ sudo npm install -g...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install GO111MODULE=on go install github.com/jaeles-project/gospider@latest Docker...

CVE-2026-114463 CVE-2026-114463

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...

CVE-2026-114463

The webhook platform gateway in Nous Research Hermes Agent is vulnerable to an authorization bypass. The gateway constructs the session chat_id using the format webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting this string. If a {route_name} contains a colon (:)...

EUVD-2026-107306

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...

CVE-2026-114463 CVE-2026-114463

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...

clawpatrol

clawpatrol The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request...

nightcrawler

Nightcrawler An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity. ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀█ ▄▀█ █░█░█ █░░...

pivotnacci

pivotnacci Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following: This tool was inspired by the great reGeorg. However, it includes some improvements: Support for...

EUVD-2026-107259

A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. Th...

pipelock

Open-source AI agent firewall forVerifiable Egress Control. !pipelock...

jvmtiAgentLoad-Exploit

Arbitrary code execution via jvmtiAgentLoad Description: Tools and code for generating a malicious JAR to exploit jvmtiAgentLoad Usage: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Linux Target The following command generates a JAR mal.jar that can be used on ...

CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Request Forgery CWE-918 in RAGFlow's agent workflow "Invoke" component, before 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Fixed in| v0.26.3 Fix commits| c4fe68e, e16d1a0 Issue refs|...

agent_tesla_panel_rce

agentteslapanelrce This module exploit the command injection vulnerability in control center of the agent Tesla. Setup Resources for testing are available here: https://github.com/mekhalleh/agentteslapanelrce/tree/master/resources Windows For WebPanel1.7z unauthenticated RCE, I used WAMP server...

CVE-2026-2256-PoC

CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...

pentx-vapt-skill

🔥 Pentx — Advanced VAPT Skill AI-Powered Penetration Testing Agent for Pi Coding Agent Pentx is an advanced 5-phase VAPT Vulnerability Assessment & Penetration Testing skill that executes full penetration testing and generates detailed Proof-of-Concept for every finding. 📸 Screenshots Tool Check|...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

CVE_POC_test

CVEPOCtest Reproduction and POC test code for CVE-2019-13086 vulnerability Original CVE information: https://vulners.com/cve/CVE-2019-13086 Test environment: CSZ CMS architecture + php5.4 + MySQL 5.5 + Apache 2.4 Vulnerability types: SQL injection vulnerability File upload vulnerability Brief...

CVE-2026-30741

Security Advisory: CVE-2026-30741 Product: OpenClaw Agent Platform Affected Versions: v2026.2.6 and earlier Vulnerability Type: Remote Code Execution RCE via Request-Side Prompt Injection Description: A lack of integrity validation for upstream API requests allows for request-stream poisoning. Th...

agent-skills

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...