BitterSecurity vulnerabilities

Products

• Decepticon 1
• decepticon-core 1
• decepticon-sdk 1

Latest BitterSecurity CVEs

Newest publication first

1. CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

   Published 2026-09-24

   Critical·CVSS 10.0

   Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deploy...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.