weevely3

Weevely - Shell web armamentizado Descripción Weevely es un shell web diseñado para fines de post-explotación que puede extenderse a través de la red en tiempo de ejecución. Suba el agente PHP de weevely a un servidor web objetivo para obtener acceso remoto a un shell en él. Tiene más de 30 módul...

porterminal

Give your agent any computer One command. One URL. A real terminal for your agent, a live view for you. Run Porterminal on a Windows, macOS, or Linux computer and give the generated link to your AI agent. It gets a real shell with the files, tools, and projects on that machine. Open the same link...

openclaw-dashboard

Panel de Control del Agente OpenClaw Un panel de monitoreo en tiempo real, seguro y atractivo para agentes OpenClaw. Rastrea sesiones, monitorea el uso de la API, visualiza costos, gestiona archivos de memoria y mantén un seguimiento de la salud del sistema, todo en un solo lugar. Capturas de...

CVE-2026-18418

The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...

CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name

The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...

CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name

The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...

CVE-2026-18418

The zbus proxy agent IPC backend in Zephyr (specifically zbus_proxy_agent_ipc.c) is vulnerable to an out-of-bounds read when logging rejected inter-domain frames. The vulnerability occurs because the channel_name[] array in struct zbus_proxy_msg may lack NUL-termination, and the logging logic use...

osmedeus

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

pentagi

PentAGI P enetration testing A rtificial G eneral I ntelligence Join the Community! Connect with security researchers, AI enthusiasts, and fellow ethical hackers. Get support, share insights, and stay updated with the latest PentAGI developments. ⠀ Table of Contents Overview Features Architecture...

CVE-2026-108864

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108850

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

sandbox-runtime

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

EUVD-2026-97015

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864

The iFlytek Astron Agent (through version 1.1.2 ) is vulnerable to an insecure direct object reference (IDOR) in the POST /workflow/v1/resume endpoint. This flaw allows authenticated applications to resume paused workflows belonging to other applications by supplying a predictable Snowflake event...

CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

EUVD-2026-97001

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

CVE-2026-108850

The Company Research Agent software (versions through 2.2.0 ) is vulnerable to a server-side request forgery (SSRF) via the /generate-pdf endpoint. The root cause is the injection of unescaped ReportLab paragraph markup into the report_content parameter. Unauthenticated attackers can embed inline...

CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...