GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests

OpenAI on Thursday officially unveiled GPT‑6 Astra , which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence AI company said the model had reached the "Critical" cybersecurity capability threshold under its Preparedness...

codex-security npm-v0.1.25

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. Features Scan repositories, selected paths, or Git changes. Deep scans run parallel discovery workers on repositories and selected paths. Validate candidate...

PT-2026-85572

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image url, audio url, or video url parameters to make the serve...

CVE-2026-85673: Server-Side Request Forgery (SSRF)

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85686: Server-Side Request Forgery (SSRF)

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

Nobody Is Saying Why OpenAI and Anthropic Had Outages Today

ChatGPT, Claude, and Grok all suffered outages at nearly the exact same time for reasons that remain murky...

dbeaver v26.2.0

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

CVE-2026-19593

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause G...

CVE-2026-19591

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

The OpenAI Codex CLI (versions 0.102.0 through 0.130.0) and Codex Desktop (macOS versions 260202.0859 through 26.513.31313; Windows versions 26.304.38 through 26.513.40821 and Microsoft Store package 26.304.38.0 through 26.513.4821.0) are vulnerable to remote code execution via the GitSpawn flaw....

EUVD-2026-69396

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19592

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2026-19593

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause G...

CVE-2026-19593

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause G...

CVE-2026-19593

The OpenAI Codex Desktop application for Windows and macOS is vulnerable to remote code execution due to a lack of proper sanitization of configuration settings. When a user opens a workspace containing a repository with a malicious .git/config file, the attr.tree setting and configured clean or ...

EUVD-2026-69395

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause G...

CVE-2026-19591

The OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) are vulnerable to Remote Code Execution (RCE) due to the improper neutralization of control sequences. A discrepancy exists where the command-safety parser incorrectly interprets PowerShell's stop-parsing token (--%) ...