red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

EUVD-2026-103293

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

kunglao-agent

kunglao-agent An autonomous reverse-engineering agent that runs for hours unattended, verifies every conclusion independently, and converges only when every answer survives a mechanical oracle verdict. 🧠 plans its own route · 🔬 every claim machine-checked · ⚖️ blind verification on everything · 📈...

log4j-jndi-be-gone

log4j-jndi-be-gone A Byte Buddy Java agent-based fix for CVE-2021-44228, the log4j 2.x "JNDI LDAP" vulnerability. It does three things: Disables the internal method handler for jndi: format strings "lookups". Logs a message to System.err i.e stderr indicating that a log4j JNDI attempt has been ma...

CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – CheckMK Agent Local Privilege Escalation PoC This repository contains a simple and clean proof-of-concept for CVE-2024-0670, a local privilege escalation vulnerability in the CheckMK Windows Agent. A low-privileged user can gain SYSTEM privileges by abusing writable temp file path...

CVE-2024-43044-jenkins-creds

Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read credentials.xml file and get secret keys to decrypt it. Initial code : https://github.com/convisolabs/CVE-2024-43044-jenkins...

CVE-2024-9950-PoC

CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07 Detail My Blog Info Vulnerability: Creation of Temporary Script in Directory with Insecure Permissions Severity: Medium to High Vector: Local Windows OS machine Attack Complexity: Low Privileges Required: Low Categories: Local Privilege...

LeitWacht

GitLab Runner Leitwacht Network egress enforcement for GitLab Runner CI/CD containers. Leitwacht prevents supply chain attacks from exfiltrating secrets by controlling what each job container can access on the network. How It Works Leitwacht is a standalone agent that runs alongside GitLab Runner...

CVE-2026-42978-PoC-Research

CVE-2026-42978 Windows Push Notifications Module for AI Security Tool Next-Gen AI Security Ecosystem, Multi-Protocol Terminal & Autonomous Agent Suite Website · Product docs · Host application · Community chat Website navigation: Home · Updates · Downloads · Modules Official host application...

webhandler

WebHandler A handler for PHP system functions & also an alternative 'netcat' handler Info WebHandler tries to simulate a 'Linux bash prompt' to handle and process: - PHP program execution functions e.g. system, passthru, exec, etc - Bind shell connections - Reserve shell connections Another featu...

AgentGuard

AgentGuard Zero-trust sandbox for autonomous AI agents. AgentGuard wraps any AI agent LangChain, CrewAI, AutoGen, custom scripts with safety rails. One command change: Before dangerous — agent has full system access python myagent.py After sandboxed agentguard run -- python myagent.py AgentGuard...

kraker

About Setup Server Setup Agent Setup Build from source Using release Contacts About Kraker is a distributed password brute-force system that allows you to run and manage the hashcat on different servers and workstations, focused on easy of use. There were two main goals during the design and...

Talon

Talon Talon is a 3rd party agent for Havoc written in C. It's very minimalistic and it's meant to show how to work with the Havoc service api. Talon.py is the script that handles callbacks, register reqeuest and tasks by interacting with the Havoc service api...

airstrike

AirStrike Stage0 This project is a Stage0 C2 that is highly customizable and can be used to create a template for your own C2 or to use it as a base for your own C2 agents. Currently there are 4 different parts to this project 1. agent is a folder which has two different agents, one is written in...

PyHmmm

PyHmmm What is this? This is a third party agent for Havoc C2 written in python. It is intended to be a basic PoC used to learn how to write custom Havoc agents, with its accompanying blog post...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...

ReverseSock5Proxy

Reverse TCP Sock5 Proxy A tiny Reverse Sock5 Proxy Server The Server GUI Built with ImGui :V U can download a prebuilt from Releases. Build You need gcc version 12+ recommended one for windows Conan Package Manager And run any script from the scripts folder, depend on your needs :V Client/Agent...

CVE-2021-44228

CVE-2021-44228 Using Log4j 2.14 library Vulnerable in User-Agent, POST method and entrypoint /admin/cores?foo= I have uploaded it in Docker Hub: you can pull and run it https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

exim-cve-2019-10149-data

Exim CVE Data Collection Data Collection Related to Exim Vulnerabilities CVE-2019-10149, CVE-2019-15846, CVE-2019-16928 CVE Announcement: https://vulners.com/cve/CVE-2019-10149 Exploit Details: https://www.exploit-db.com/exploits/46974 Issue Timeline: https://seclists.org/fulldisclosure/2019/Jun/...