Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, a
Casky was already ahead
This CVE exploits attack patterns that Casky's 427matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120338.
Casky has 427 skills that investigate the attack patterns behind CVE-2026-120338. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →Access with Stolen Session Cookie
identity access management · low
Access with Stolen Session Cookie
identity access management · low
Access with Stolen Session Cookie
penetration testing · medium
Account Access Removal
cloud security · low
Account Manipulation
identity access management · low
Account Manipulation
cloud security · low
Account Manipulation
identity access management · low
Account Manipulation: Account Linking
cloud security · low
Account Manipulation: Add Authorized User
identity access management · low
Account Manipulation: Change Account Details
cloud security · low
Account Manipulation: Change of Payment Details
phishing defense · medium
Account Manipulation: Enable Account Features
identity access management · low
Account Manipulation: Enable Account Features
identity access management · low
Account Takeover
identity access management · low
Account Takeover
red teaming · high
Account Takeover
phishing defense · medium
Account Takeover
identity access management · low
Account Takeover
identity access management · low
Account Takeover
red teaming · high
Account Takeover: Exposed Login Credential
identity access management · low
Account Takeover: Exposed Login Credential
identity access management · low
Account Takeover: Exposed Login Credential
red teaming · high
Account Takeover: Exposed Login Credential
identity access management · low
Account Takeover: Exposed Login Credential
phishing defense · medium
Account Takeover: Password Reset
identity access management · low
achieving-cmmc-level-2-compliance
compliance governance · low
Adversary-in-the-Middle
identity access management · low
analyzing-apt-group-with-mitre-navigator
threat intelligence · low
analyzing-campaign-attribution-evidence
threat intelligence · low
analyzing-cloud-storage-access-patterns
cloud security · low
analyzing-cyber-kill-chain
threat intelligence · low
analyzing-ios-app-security-with-objection
mobile security · low
analyzing-kubernetes-audit-logs
container security · low
analyzing-malicious-url-with-urlscan
phishing defense · medium
analyzing-malware-family-relationships-with-malpedia
threat intelligence · low
analyzing-office365-audit-logs-for-compromise
cloud security · low
analyzing-threat-actor-ttps-with-mitre-attack
threat intelligence · low
analyzing-threat-actor-ttps-with-mitre-navigator
threat intelligence · low
analyzing-threat-intelligence-feeds
threat intelligence · low
analyzing-threat-landscape-with-misp
threat intelligence · low
attacking-entra-id-with-roadtools
identity access management · low
attacking-oauth-with-device-code-phishing
identity access management · low
auditing-aws-s3-bucket-permissions
cloud security · low
auditing-azure-active-directory-configuration
cloud security · low
auditing-cloud-with-cis-benchmarks
cloud security · low
auditing-entra-id-with-aadinternals
identity access management · low
auditing-gcp-iam-permissions
cloud security · low
auditing-kubernetes-rbac-privilege-escalation
container security · low
auditing-terraform-infrastructure-for-security
cloud security · low
auditing-tls-certificate-transparency-logs
threat intelligence · low
automating-ioc-enrichment
threat intelligence · low
benchmarking-kubernetes-with-kube-bench
container security · low
Browser Session Hijacking
cloud security · low
Brute Force: Credential Stuffing
threat intelligence · low
building-adversary-infrastructure-tracking-system
threat intelligence · low
building-attack-pattern-library-from-cti-reports
threat intelligence · low
building-c2-infrastructure-with-sliver-framework
red teaming · high
building-c2-redirector-infrastructure
red teaming · high
building-cloud-siem-with-sentinel
cloud security · low
building-devsecops-pipeline-with-gitlab-ci
devsecops · low
building-ioc-defanging-and-sharing-pipeline
threat intelligence · low
building-ioc-enrichment-pipeline-with-opencti
threat intelligence · low
building-patch-tuesday-response-process
vulnerability management · medium
building-red-team-c2-infrastructure-with-havoc
red teaming · high
building-role-mining-for-rbac-optimization
identity access management · low
building-threat-actor-profile-from-osint
threat intelligence · low
building-threat-feed-aggregation-with-misp
threat intelligence · low
building-threat-intelligence-platform
threat intelligence · low
building-vulnerability-aging-and-sla-tracking
vulnerability management · medium
building-vulnerability-dashboard-with-defectdojo
vulnerability management · medium
building-vulnerability-exception-tracking-system
vulnerability management · medium
bypassing-authentication-with-forced-browsing
web application security · medium
coercing-authentication-with-coercer-petitpotam
red teaming · high
collecting-open-source-intelligence
threat intelligence · low
collecting-threat-intelligence-with-misp
threat intelligence · low
conducting-api-security-testing
penetration testing · medium
conducting-cloud-penetration-testing
cloud security · low
conducting-cyber-risk-assessment-with-nist-800-30
compliance governance · low
conducting-domain-persistence-with-dcsync
red teaming · high
conducting-external-reconnaissance-with-osint
penetration testing · medium
conducting-full-scope-red-team-engagement
red teaming · high
conducting-gdpr-compliance-assessment
compliance governance · low
conducting-internal-network-penetration-test
penetration testing · medium
conducting-internal-reconnaissance-with-bloodhound-ce
red teaming · high
conducting-mobile-app-penetration-test
penetration testing · medium
conducting-network-penetration-test
penetration testing · medium
conducting-pass-the-ticket-attack
red teaming · high
conducting-wireless-network-penetration-test
penetration testing · medium
configuring-active-directory-tiered-model
identity access management · low
configuring-aws-verified-access-for-ztna
zero trust architecture · low
configuring-host-based-intrusion-detection
endpoint security · low
configuring-microsegmentation-for-zero-trust
zero trust architecture · low
configuring-multi-factor-authentication-with-duo
identity access management · low
configuring-windows-defender-advanced-settings
endpoint security · low
configuring-windows-event-logging-for-detection
endpoint security · low
configuring-zscaler-private-access-for-ztna
zero trust architecture · low
Convert to Cryptocurrency
cloud security · low
correlating-threat-campaigns
threat intelligence · low
Create Fake Materials: Fake Website
phishing defense · medium
Create Fake Materials: Fake Website
phishing defense · medium
Create Fake Materials: Fake Website
phishing defense · medium
Create Fake Materials: Fake Website
phishing defense · medium
Create Fake Materials: Fake Website
threat intelligence · low
Create Fake Materials: Fake Website
penetration testing · medium
Delete Relevant Emails
phishing defense · medium
deploying-cloudflare-access-for-zero-trust
zero trust architecture · low
deploying-edr-agent-with-crowdstrike
endpoint security · low
deploying-osquery-for-endpoint-monitoring
endpoint security · low
deploying-palo-alto-prisma-access-zero-trust
zero trust architecture · low
deploying-software-defined-perimeter
zero trust architecture · low
deploying-tailscale-for-zero-trust-vpn
zero trust architecture · low
detecting-api-enumeration-attacks
api security · medium
detecting-aws-guardduty-findings-automation
cloud security · low
detecting-aws-iam-privilege-escalation
cloud security · low
detecting-azure-lateral-movement
cloud security · low
detecting-azure-service-principal-abuse
cloud security · low
detecting-azure-storage-account-misconfigurations
cloud security · low
detecting-broken-object-property-level-authorization
api security · medium
detecting-cloud-threats-with-guardduty
cloud security · low
detecting-container-drift-at-runtime
container security · low
detecting-container-escape-attempts
container security · low
detecting-container-escape-with-falco-rules
container security · low
detecting-container-runtime-threats-with-falco
container security · low
detecting-evasion-techniques-in-endpoint-logs
endpoint security · low
detecting-fileless-attacks-on-endpoints
endpoint security · low
detecting-misconfigured-azure-storage
cloud security · low
detecting-privilege-escalation-in-kubernetes-pods
container security · low
detecting-s3-data-exfiltration-attempts
cloud security · low
detecting-serverless-function-injection
cloud security · low
detecting-shadow-api-endpoints
api security · medium
detecting-shadow-it-cloud-usage
cloud security · low
detecting-suspicious-oauth-application-consent
cloud security · low
Device Fingerprint Spoofing
identity access management · low
Device Fingerprint Spoofing
identity access management · low
Electronic Funds Transfer: Wire Transfer
threat intelligence · low
Electronic Funds Transfer: Wire Transfer
phishing defense · medium
Email Spoofing
threat intelligence · low
emulating-cloud-attacks-with-stratus-red-team
cloud security · low
enumerating-cloud-with-cloudfox
cloud security · low
escaping-containers-to-host
container security · low
evaluating-threat-intelligence-platforms
threat intelligence · low
executing-active-directory-attack-simulation
penetration testing · medium
executing-nist-rmf-authorization-to-operate
compliance governance · low
executing-red-team-engagement-planning
red teaming · high
executing-red-team-exercise
penetration testing · medium
exploiting-active-directory-certificate-services-esc1
red teaming · high
exploiting-active-directory-with-bloodhound
red teaming · high
exploiting-adcs-with-certipy
red teaming · high
exploiting-api-injection-vulnerabilities
api security · medium
exploiting-aws-with-pacu
cloud security · low
exploiting-broken-function-level-authorization
api security · medium
exploiting-broken-link-hijacking
web application security · medium
exploiting-constrained-delegation-abuse
red teaming · high
exploiting-deeplink-vulnerabilities
mobile security · low
exploiting-excessive-data-exposure-in-api
api security · medium
exploiting-http-request-smuggling
web application security · medium
exploiting-idor-vulnerabilities
web application security · medium
exploiting-insecure-data-storage-in-mobile
mobile security · low
exploiting-insecure-deserialization
web application security · medium
exploiting-jwt-algorithm-confusion-attack
api security · medium
exploiting-kerberoasting-with-impacket
red teaming · high
exploiting-mass-assignment-in-rest-apis
web application security · medium
exploiting-ms17-010-eternalblue-vulnerability
red teaming · high
exploiting-nopac-cve-2021-42278-42287
red teaming · high
exploiting-nosql-injection-vulnerabilities
web application security · medium
exploiting-oauth-misconfiguration
web application security · medium
exploiting-prototype-pollution-in-javascript
web application security · medium
exploiting-race-condition-vulnerabilities
web application security · medium
exploiting-server-side-request-forgery
web application security · medium
exploiting-sql-injection-vulnerabilities
penetration testing · medium
exploiting-sql-injection-with-sqlmap
web application security · medium
exploiting-template-injection-vulnerabilities
web application security · medium
exploiting-type-juggling-vulnerabilities
web application security · medium
exploiting-vulnerabilities-with-metasploit-framework
vulnerability management · medium
exploiting-websocket-vulnerabilities
web application security · medium
exploiting-zerologon-vulnerability-cve-2020-1472
red teaming · high
Gather Customer Information
threat intelligence · low
generating-threat-intelligence-reports
threat intelligence · low
hardening-docker-containers-for-production
container security · low
hardening-docker-daemon-configuration
container security · low
hardening-linux-endpoint-with-cis-benchmark
endpoint security · low
hardening-windows-endpoint-with-cis-benchmark
endpoint security · low
hunting-advanced-persistent-threats
threat intelligence · low
Impersonate Account Holder
phishing defense · medium
Impersonate Account Holder
phishing defense · medium
implementing-api-abuse-detection-with-rate-limiting
api security · medium
implementing-api-gateway-security-controls
api security · medium
implementing-api-key-security-controls
api security · medium
implementing-api-rate-limiting-and-throttling
api security · medium
implementing-api-schema-validation-security
api security · medium
implementing-api-security-posture-management
api security · medium
implementing-api-security-testing-with-42crunch
api security · medium
implementing-api-threat-protection-with-apigee
api security · medium
implementing-application-whitelisting-with-applocker
endpoint security · low
implementing-aqua-security-for-container-scanning
devsecops · low
implementing-attack-path-analysis-with-xm-cyber
vulnerability management · medium
implementing-aws-config-rules-for-compliance
cloud security · low
implementing-aws-iam-permission-boundaries
identity access management · low
implementing-aws-macie-for-data-classification
cloud security · low
implementing-aws-nitro-enclave-security
cloud security · low
implementing-aws-security-hub
cloud security · low
implementing-aws-security-hub-compliance
cloud security · low
implementing-azure-defender-for-cloud
cloud security · low
implementing-beyondcorp-zero-trust-access-model
zero trust architecture · low
implementing-cisa-zero-trust-maturity-model
zero trust architecture · low
implementing-cloud-dlp-for-data-protection
cloud security · low
implementing-cloud-security-posture-management
cloud security · low
implementing-cloud-trail-log-analysis
cloud security · low
implementing-cloud-vulnerability-posture-management
vulnerability management · medium
implementing-cloud-waf-rules
cloud security · low
implementing-cloud-workload-protection
cloud security · low
implementing-code-signing-for-artifacts
devsecops · low
implementing-conditional-access-policies-azure-ad
identity access management · low
implementing-container-image-minimal-base-with-distroless
container security · low
implementing-container-network-policies-with-calico
container security · low
implementing-continuous-security-validation-with-bas
vulnerability management · medium
implementing-device-posture-assessment-in-zero-trust
zero trust architecture · low
implementing-diamond-model-analysis
threat intelligence · low
implementing-disk-encryption-with-bitlocker
endpoint security · low
implementing-dmarc-dkim-spf-email-security
phishing defense · medium
implementing-email-sandboxing-with-proofpoint
phishing defense · medium
implementing-endpoint-dlp-controls
endpoint security · low
implementing-epss-score-for-vulnerability-prioritization
vulnerability management · medium
implementing-file-integrity-monitoring-with-aide
endpoint security · low
implementing-fuzz-testing-in-cicd-with-aflplusplus
devsecops · low
implementing-gcp-binary-authorization
cloud security · low
implementing-gcp-organization-policy-constraints
cloud security · low
implementing-gcp-vpc-firewall-rules
cloud security · low
implementing-gdpr-data-protection-controls
compliance governance · low
implementing-github-advanced-security-for-code-scanning
devsecops · low
implementing-hipaa-security-rule-safeguards
compliance governance · low
implementing-image-provenance-verification-with-cosign
container security · low
implementing-infrastructure-as-code-security-scanning
devsecops · low
implementing-iso-27001-information-security-management
compliance governance · low
implementing-just-in-time-access-provisioning
identity access management · low
implementing-kubernetes-network-policy-with-calico
container security · low
implementing-kubernetes-pod-security-standards
container security · low
implementing-memory-protection-with-dep-aslr
endpoint security · low
implementing-microsegmentation-with-guardicore
zero trust architecture · low
implementing-mobile-application-management
mobile security · low
implementing-network-policies-for-kubernetes
container security · low
implementing-opa-gatekeeper-for-policy-enforcement
container security · low
implementing-passwordless-authentication-with-fido2
identity access management · low
implementing-patch-management-workflow
vulnerability management · medium
implementing-pci-dss-compliance-controls
compliance governance · low
implementing-pod-security-admission-controller
container security · low
implementing-policy-as-code-with-open-policy-agent
devsecops · low
implementing-privileged-session-monitoring
identity access management · low
implementing-rapid7-insightvm-for-scanning
vulnerability management · medium
implementing-rbac-hardening-for-kubernetes
container security · low
implementing-runtime-security-with-tetragon
container security · low
implementing-secret-scanning-with-gitleaks
devsecops · low
implementing-secrets-management-with-vault
cloud security · low
implementing-secrets-scanning-in-ci-cd
devsecops · low
implementing-security-information-sharing-with-stix2
threat intelligence · low
implementing-semgrep-for-custom-sast-rules
devsecops · low
implementing-stix-taxii-feed-integration
threat intelligence · low
implementing-supply-chain-security-with-in-toto
container security · low
implementing-taxii-server-with-opentaxii
threat intelligence · low
implementing-threat-intelligence-lifecycle-management
threat intelligence · low
implementing-usb-device-control-policy
endpoint security · low
implementing-vulnerability-management-with-greenbone
vulnerability management · medium
implementing-vulnerability-remediation-sla
vulnerability management · medium
implementing-vulnerability-sla-breach-alerting
vulnerability management · medium
implementing-web-application-logging-with-modsecurity
web application security · medium
implementing-zero-standing-privilege-with-cyberark
identity access management · low
implementing-zero-trust-dns-with-nextdns
zero trust architecture · low
implementing-zero-trust-for-saas-applications
zero trust architecture · low
implementing-zero-trust-in-cloud
cloud security · low
implementing-zero-trust-network-access
cloud security · low
implementing-zero-trust-network-access-with-zscaler
zero trust architecture · low
Insider Access Abuse
identity access management · low
Insider Access Abuse
zero trust architecture · low
integrating-dast-with-owasp-zap-in-pipeline
devsecops · low
integrating-sast-into-github-actions-pipeline
devsecops · low
intercepting-mobile-traffic-with-burpsuite
mobile security · low
managing-intelligence-lifecycle
threat intelligence · low
managing-third-party-vendor-risk
compliance governance · low
mapping-attack-paths-with-bloodhound-ce
red teaming · high
mapping-mitre-attack-techniques
threat intelligence · low
modeling-threats-with-opencti
threat intelligence · low
moving-laterally-with-netexec
penetration testing · medium
operating-havoc-c2
red teaming · high
operating-sliver-c2
red teaming · high
operationalizing-misp-threat-feeds
threat intelligence · low
performing-access-review-and-certification
identity access management · low
performing-active-directory-bloodhound-analysis
red teaming · high
performing-active-directory-penetration-test
penetration testing · medium
performing-active-directory-vulnerability-assessment
vulnerability management · medium
performing-agentless-vulnerability-scanning
vulnerability management · medium
performing-ai-driven-osint-correlation
threat intelligence · low
performing-android-app-static-analysis-with-mobsf
mobile security · low
performing-api-fuzzing-with-restler
api security · medium
performing-api-inventory-and-discovery
api security · medium
performing-api-rate-limiting-bypass
api security · medium
performing-api-security-testing-with-postman
api security · medium
performing-asset-criticality-scoring-for-vulns
vulnerability management · medium
performing-authenticated-scan-with-openvas
vulnerability management · medium
performing-authenticated-vulnerability-scan
vulnerability management · medium
performing-aws-account-enumeration-with-scout-suite
cloud security · low
performing-aws-privilege-escalation-assessment
cloud security · low
performing-blind-ssrf-exploitation
web application security · medium
performing-clickjacking-attack-test
web application security · medium
performing-cloud-asset-inventory-with-cartography
cloud security · low
performing-cloud-forensics-with-aws-cloudtrail
cloud security · low
performing-cloud-log-forensics-with-athena
cloud security · low
performing-cloud-native-forensics-with-falco
cloud security · low
performing-cloud-native-threat-hunting-with-aws-detective
cloud security · low
performing-cloud-penetration-testing-with-pacu
cloud security · low
performing-container-escape-detection
container security · low
performing-container-image-hardening
devsecops · low
performing-container-security-scanning-with-trivy
container security · low
performing-content-security-policy-bypass
web application security · medium
performing-csrf-attack-simulation
web application security · medium
performing-cve-prioritization-with-kev-catalog
vulnerability management · medium
performing-dark-web-monitoring-for-threats
threat intelligence · low
performing-directory-traversal-testing
web application security · medium
performing-dmarc-policy-enforcement-rollout
phishing defense · medium
performing-docker-bench-security-assessment
container security · low
performing-dynamic-analysis-of-android-app
mobile security · low
performing-endpoint-forensics-investigation
endpoint security · low
performing-endpoint-vulnerability-remediation
endpoint security · low
performing-external-network-penetration-test
penetration testing · medium
performing-gcp-penetration-testing-with-gcpbucketbrute
cloud security · low
performing-gcp-security-assessment-with-forseti
cloud security · low
performing-graphql-depth-limit-attack
api security · medium
performing-graphql-introspection-attack
api security · medium
performing-graphql-security-assessment
web application security · medium
performing-http-parameter-pollution-attack
web application security · medium
performing-indicator-lifecycle-management
threat intelligence · low
performing-ios-app-security-assessment
mobile security · low
performing-iot-security-assessment
penetration testing · medium
performing-ip-reputation-analysis-with-shodan
threat intelligence · low
performing-jwt-none-algorithm-attack
api security · medium
performing-kerberoasting-attack
red teaming · high
performing-kubernetes-cis-benchmark-with-kube-bench
container security · low
performing-kubernetes-etcd-security-assessment
container security · low
performing-kubernetes-penetration-testing
container security · low
performing-lateral-movement-with-wmiexec
red teaming · high
performing-malware-hash-enrichment-with-virustotal
threat intelligence · low
performing-malware-ioc-extraction
threat intelligence · low
performing-mobile-app-certificate-pinning-bypass
mobile security · low
performing-nist-csf-maturity-assessment
compliance governance · low
performing-open-source-intelligence-gathering
red teaming · high
performing-osint-with-spiderfoot
threat intelligence · low
performing-physical-intrusion-assessment
red teaming · high
performing-privilege-escalation-assessment
penetration testing · medium
performing-privilege-escalation-on-linux
red teaming · high
performing-privileged-account-access-review
identity access management · low
performing-privileged-account-discovery
identity access management · low
performing-sca-dependency-scanning-with-snyk
devsecops · low
performing-second-order-sql-injection
web application security · medium
performing-security-headers-audit
web application security · medium
performing-serverless-function-security-review
cloud security · low
performing-service-account-audit
identity access management · low
performing-soap-web-service-security-testing
api security · medium
performing-subdomain-enumeration-with-subfinder
web application security · medium
performing-thick-client-application-penetration-test
penetration testing · medium
performing-threat-emulation-with-atomic-red-team
threat intelligence · low
performing-threat-intelligence-sharing-with-misp
threat intelligence · low
performing-threat-landscape-assessment-for-sector
threat intelligence · low
performing-threat-modeling-with-owasp-threat-dragon
devsecops · low
performing-vulnerability-scanning-with-nessus
penetration testing · medium
performing-web-application-firewall-bypass
web application security · medium
performing-web-application-penetration-test
penetration testing · medium
performing-web-application-scanning-with-nikto
vulnerability management · medium
performing-web-application-vulnerability-triage
vulnerability management · medium
performing-web-cache-deception-attack
web application security · medium
performing-web-cache-poisoning-attack
web application security · medium
performing-wireless-network-penetration-test
penetration testing · medium
Phishing
threat intelligence · low
Phishing
threat intelligence · low
Phishing for Information
zero trust architecture · low
Phone Number Spoofing: Official Phone Number Spoofing
red teaming · high
post-exploiting-microsoft-graph-with-graphrunner
identity access management · low
prioritizing-vulnerabilities-with-cvss-scoring
vulnerability management · medium
processing-stix-taxii-feeds
threat intelligence · low
profiling-threat-actor-groups
threat intelligence · low
relaying-ntlm-for-adcs-esc8
red teaming · high
remediating-s3-bucket-misconfiguration
cloud security · low
reverse-engineering-ios-app-with-frida
mobile security · low
scanning-container-images-with-grype
container security · low
scanning-containers-with-trivy-in-cicd
devsecops · low
scanning-docker-images-with-trivy
container security · low
scanning-iac-and-images-with-trivy
devsecops · low
scanning-infrastructure-with-nessus
vulnerability management · medium
scanning-kubernetes-manifests-with-kubesec
container security · low
securing-api-gateway-with-aws-waf
cloud security · low
securing-aws-lambda-execution-roles
cloud security · low
securing-azure-with-microsoft-defender
cloud security · low
securing-container-registry-images
cloud security · low
securing-container-registry-with-harbor
container security · low
securing-github-actions-workflows
devsecops · low
securing-helm-chart-deployments
container security · low
securing-kubernetes-on-cloud
cloud security · low
securing-serverless-functions
cloud security · low
Stage Capabilities: SEO Poisoning
threat intelligence · low
Steal Web Session Cookie
identity access management · low
Steal Web Session Cookie
identity access management · low
Steal Web Session Cookie
zero trust architecture · low
testing-android-intents-for-vulnerabilities
mobile security · low
testing-api-authentication-weaknesses
api security · medium
testing-api-for-broken-object-level-authorization
api security · medium
testing-api-for-mass-assignment-vulnerability
api security · medium
testing-api-security-with-owasp-top-10
web application security · medium
testing-cors-misconfiguration
web application security · medium
testing-for-broken-access-control
web application security · medium
testing-for-business-logic-vulnerabilities
web application security · medium
testing-for-email-header-injection
web application security · medium
testing-for-host-header-injection
web application security · medium
testing-for-json-web-token-vulnerabilities
web application security · medium
testing-for-open-redirect-vulnerabilities
web application security · medium
testing-for-sensitive-data-exposure
web application security · medium
testing-for-xml-injection-vulnerabilities
web application security · medium
testing-for-xss-vulnerabilities
penetration testing · medium
testing-for-xss-vulnerabilities-with-burpsuite
web application security · medium
testing-for-xxe-injection-vulnerabilities
web application security · medium
testing-jwt-token-security
web application security · medium
testing-mobile-api-authentication
mobile security · low
testing-oauth2-implementation-flaws
api security · medium
testing-websocket-api-security
api security · medium
triaging-vulnerabilities-with-ssvc-framework
vulnerability management · medium
Use Alternate Authentication Material: Application Access Token
cloud security · low
Use Alternate Authentication Material: Application Access Token
cloud security · low
© 2026 Casky.AI, Inc. · AI Security Investigation