inspect_petri

Inspect Petri Welcome to Inspect Petri, an auditing agent that enables automated monitoring and interaction with language models to detect potential alignment issues, reward hacking, and other concerning behaviors. Petri helps you rapidly test concrete alignment hypotheses end‑to‑end. It: Generat...

stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

socbench

socbench Benchmark frontier reasoning LLMs as SOC agents on raw NetFlow data. socbench benchmarks frontier reasoning models as SOC agents: each model runs a bounded multi-turn agent loop against a deterministic, pre-indexed NetFlow corpus, with persona-scoped read-only tools, fixed dollar caps pe...

TRACE

TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking Official implementation for TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking. 📖 Overview Large language model LLM agents can autonomously plan, invoke tools, interact with environments, and execute long-horizon workflows...

resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

INTACT

SoK Multi-Turn Jailbreak Experiments This repository contains the release version of the code used for the mechanism analyses in SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks. The repository has been trimmed to keep only code, prompts, configuration files, and datasets needed ...

PE-CoA

PE-CoA Code Implementation of "Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models" The full paper is available at: https://arxiv.org/pdf/2510.08859 Chain of Attack Setup Instructions Installation 1. Install dependencies : pip install -r...

CVE-2026-53986

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986

The Girafit camera app (Android and iOS) version 1.9.1 and earlier , along with Girafit camera devices , are affected by a hardcoded credentials vulnerability. Attackers can obtain a shared TURN relay username by decompiling the application or intercepting unencrypted network traffic during live ...

EUVD-2026-107366

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

PT-2026-120721

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected- Ecosystem / package: pip / vllm- Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. SummaryOn the GPT-OSS "Harmony" path POST...

CompanionSafe: From Multi-Turn Safety Evaluation to Guardrails for AI Companions

AI companions provide users with emotional support and ongoing companionship, but their sustained relational interactions also introduce distinct safety risks. Prior work largely targets general harms or specific companion platforms and risk categories, while relying on manually collected...

stunner

STUNNER Stunner es una herramienta para probar y explotar servidores STUN, TURN y TURN sobre TCP. TURN es un protocolo usado principalmente en videoconferencias y chats de audio WebRTC. Si encuentras un servidor mal configurado, puedes usar esta herramienta para abrir un proxy socks local que...

Linux Distros Unpatched Vulnerability : CVE-2026-104074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a...

CVE-2026-104074

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

DEBIAN-CVE-2026-104074

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...