Security1 hOctober 7, 2026, 10:33

BugTraceAI: open-source self-hosted agentic pentester with three CVEs

BugTraceAI is an open-source, self-hosted Apache-2.0 framework for authorized bug bounty and penetration testing. AI agents drive a six-phase pipeline (recon, discovery, strategy, exploit, validate, report) while deterministic tools verify findings. Three CVEs rated 7.2–8.8 have been disclosed so far.

DEV Community

Open source

Six-phase pipeline: recon, discovery, strategy, exploit, validate, report
CVEs found: CVE-2026-27479 (Wallos, 7.7), CVE-2026-27470 (ZoneMinder, 8.8), CVE-2026-27834 (Piwigo, 7.2)
Components: CLI, WEB with 20+ security tools, API and Launcher; fully self-hosted
BugStore practice target ships 32 planted OWASP vulnerabilities

#BugTraceAI

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

Security

The AI Gateway Is Now a Credential Hub: What the LiteLLM MCP Authentication Bypass Means for Self-Hosted LLM Infrastructure

IBM brings Bob to self-hosted and air-gapped environments

Software

BugTraceAI: open-source self-hosted agentic pentester with three CVEs

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

The AI Gateway Is Now a Credential Hub: What the LiteLLM MCP Authentication Bypass Means for Self-Hosted LLM Infrastructure

IBM brings Bob to self-hosted and air-gapped environments

PewDiePie's free self-hosted image editor does what Adobe and Canva charge for