socbench

socbench Benchmark frontier reasoning LLMs as SOC agents on raw NetFlow data. socbench benchmarks frontier reasoning models as SOC agents: each model runs a bounded multi-turn agent loop against a deterministic, pre-indexed NetFlow corpus, with persona-scoped read-only tools, fixed dollar caps pe...

inspect_petri

Inspect Petri Welcome to Inspect Petri, an auditing agent that enables automated monitoring and interaction with language models to detect potential alignment issues, reward hacking, and other concerning behaviors. Petri helps you rapidly test concrete alignment hypotheses end‑to‑end. It: Generat...

stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

CVE-2026-104074

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

EUVD-2026-94363

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074

The Coturn software (version 4.10.0 ) is vulnerable to an uninitialized stack memory disclosure vulnerability. An unauthenticated remote attacker can leak stack memory contents by sending a TURN Allocate request without credentials. The flaw exists in the stun_init_error_response_common_str() fun...

CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

stunner

STUNNER Stunner est un outil pour tester et exploiter les serveurs STUN, TURN et TURN over TCP. TURN est un protocole principalement utilisé dans la visioconférence et les chats audio WebRTC. Si vous trouvez un serveur mal configuré, vous pouvez utiliser cet outil pour ouvrir un proxy socks local...

TRACE

TRACE: Адаптивное самоэволюционирующее агентное джейлбрейкинг-решение с учётом задач Обзор Декомпозиция задач на основе схем. Чтобы снизить сложность атаки, мы разработали около 20 процедурных схем декомпозиции, позволяющих разбить сложную вредоносную задачу на относительно безобидные и простые...

INTACT

SoK Эксперименты по многоходовым джейлбрейкам Этот репозиторий содержит релизную версию кода, использованного для анализа механизмов в работе SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks. Репозиторий был сокращён, чтобы оставить только код, промпты, конфигурационные файлы и...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

PE-CoA

PE-CoA Code Implementation of "Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models" The full paper is available at: https://arxiv.org/pdf/2510.08859 Chain of Attack Setup Instructions Installation 1. Install dependencies : pip install -r...

CVE-2026-100251

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP...

EUVD-2026-91032

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP...

CVE-2026-100251

Versions of Wormhole.app deployed before 2026-08-22 are vulnerable to a server-side request forgery (SSRF) due to a misconfiguration in the coturn TURN server . The flaw arises because the application fails to properly restrict TCP relay peers , enabling an unauthenticated attacker to access inst...

CLEANSTART-2023-MJ86716 Coturn is free open source implementation of TURN and STUN Server

Security vulnerability affects the coturn package. Coturn is free open source implementation of TURN and STUN Server...

SUSE CVE-2026-40613

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8t to uint16t without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, thi...

SUSE CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...