PT-2026-116154

Name of the Vulnerable Software and Affected Versions Claude Agent SDK versions prior to 0.2.121 Description An issue exists where the resume option is passed to the Claude CLI as a separate token without validation. This allows a value starting with a dash to be parsed as an independent CLI flag...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

PT-2026-115855

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that...

Linux Distros Unpatched Vulnerability : CVE-2026-109383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its...

PT-2026-115873

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...

UBUNTU-CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

Log4jPatch

-- This repository has been archived -- Further development of this tool will continue at corretto/hotpatch-for-apache-log4j2. Thanks for sharing, commenting, trying it out and contributing to this project! Log4jPatch This is a POC of a simple tool which injects a Java agent into a running JVM...

gatekeeper-cve-2020-8554

Gatekeeper constraint for CVE-2020-8554 Install OPA client Follow the instructions. Run unit tests $ opa test --ignore=.yaml ./policies verbose output $ opa test -v --explain=full --format=pretty --ignore=.yaml ./policies...

CVE-2026-111323

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

shouganaiyo-loader

shouganaiyo-loader: Forced Entry for Java Agents shouganaiyo-loader is a cross-platform Frida-based Node.js command-line tool that forces Java processes to load a Java/JVMTI agent regardless of whether or not the JVM has disabled the agent attach API. Install $ sudo npm install -g...

EIPP

EIPP Banned Password Lists Tools for manipulating Banned Password Lists BPL of Entra ID Password Protection. The eipp-global-bpl.txt containing the entries of the global banned password list was dumped on 2024-04-11. More info at...

geiger

geiger A Geiger counter for AI agents. One read-only command that inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch. npx geiger-scan No install. No account. No telemetry. Reads configs and directories...

skills

SpecterOps Skills Reusable agent skills, plugins, and agent definitions for SpecterOps. Use With Codex Each plugin includes a Codex manifest at .codex-plugin/plugin.json. codex plugin marketplace add /Users//Projects/skills or codex plugin marketplace add SpecterOps/skills Then open Codex and...

llm-agent-testbed

🛡️ LLM Agent Security Testbed Empirical Vulnerability & Defense Harness for Tool-Calling LLM Agents A disciplined security testbed testing whether tool-equipped LLM agents can be manipulated into unauthorized data exfiltration via prompt injection, role-claim social engineering, and confused-deput...

CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Request Forgery CWE-918 in RAGFlow's agent workflow "Invoke" component, before 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Fixed in| v0.26.3 Fix commits| c4fe68e, e16d1a0 Issue refs|...

agentZ

Zero Trust Agentic AI Platform Build, run, and govern AI agents. Secure by design. Every agent runs inside a default-deny sandbox and never receives a credential. Every agent action is traceable. AgentZ is a multi-tenant platform for running AI agents. It provides strong isolation guarantees, zer...

pentx-vapt-skill

🔥 Pentx — Advanced VAPT Skill AI-Powered Penetration Testing Agent for Pi Coding Agent Pentx is an advanced 5-phase VAPT Vulnerability Assessment & Penetration Testing skill that executes full penetration testing and generates detailed Proof-of-Concept for every finding. 📸 Screenshots Tool Check|...

CVE-2026-58073-check

Veeam Service Provider Console Agent Impersonation — Patch-State Detection Script A safe, unauthenticated detector for the KB4893 vulnerabilities in Veeam Service Provider Console published 2026-08-04. It answers one question per target, before any authentication or TLS: are the KB4893 fixes...

DEBIAN-CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...