PrivacyRaven

참고: 이 프로젝트는 일시 중단 상태입니다. PrivacyRaven 은 딥러닝 시스템을 위한 프라이버시 테스트 라이브러리입니다. 이를 사용하여 모델이 다양한 프라이버시 공격에 얼마나 취약한지 판단하고, 프라이버시 보존 머신러닝 기법을 평가하며, 새로운 프라이버시 메트릭과 공격을 개발하고, 데이터 출처data provenance 및 기타 사용 사례를 위해 공격을 재활용할 수 있습니다. PrivacyRaven은 라벨 전용 블랙박스 모델 추출, 멤버십 추론, 그리고 곧 제공될 모델 역전 공격을 지원합니다. 또한 차분 프라이버시 검증...

CLEANSTART-2026-PM55694 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-AH85401 native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, with...

Security vulnerability affects the sonarqube package. The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays withi...

CVE-2026-105753

A flaw was found in vLLM. This vulnerability allows a remote user to cause a Denial of Service DoS on the model serving engine. The issue occurs when a multimodal request is rejected after media processing, causing the frontend and backend caches to become desynchronized. A subsequent request...

PT-2026-107288

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

PT-2026-106759

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get token bin counts and mask of the file vllm/model executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attac...

tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

CVE-2023-1177

CVE-2023-1177 | | MLFlow 경로 탐색 | MLflow 2.2.0에서 테스트됨 | src: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST "$URL/ajax-api/2.0/mlflow/registered-models/create" -d...

CVE-2026-105741

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741

The software Langflow (versions 1.5.0 through 1.10.3) is vulnerable to an IP spoofing issue within the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install). An authenticated remote attacker can bypass "local-only" access restrictions by ...

mcp-attack-detection-sentinel

MCP 공격 탐지 — Sentinel 연구소 MCPModel Context Protocol 공격 패턴 에 대한 Sentinel 탐지 연구: MCP 관련 이벤트 이후의 비정상적인 ID 액세스, 도구 정의 변조, 리소스 간 액세스, 그리고 가능한 사후 악용Post-Exploitation 동작. 이 규칙들은 OWASP 에이전틱 애플리케이션 Top 10 2026에 매핑됩니다. 게시 상태: 이 저장소에는 현재 게시된 Nine Lives 동반 기사가 없으며, 웹사이트의 Labs 카탈로그에도 의도적으로 등재되지 않았습니다. 독립적인 연구...

CVE-2024-45436

Ollama CVE-2024-45436 익스플로잇 Ollama ZIP 경로 탐색 취약점CVE-2024-45436을 위한 깔끔하고 효율적인 익스플로잇 구현체입니다. 중국어 문서: READMECN.md 취약점 설명 CVE-2024-45436은 0.1.47 이전 버전의 Ollama에 존재하는 경로 탐색 취약점"Zip Slip"이라고도 함입니다. 이 취약점은 ZIP 파일 추출 작업 중 경로 검증이 부적절하게 이루어지는 점을 악용하여 공격자가 파일 시스템의 임의 위치에 파일을 쓸 수 있게 합니다. 이 결함은 모델 파일을 추출하는...

CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: TRITONBATCHSTRATEGYPATH를 통한 임의 dlopen triton-inference-server/core의 사용자 정의 배치 전략 로더에서 발생하는 절대 경로 탐색Absolute Path Traversal 취약점입니다. 모델 구성 매개변수가 검증 없이 dlopenRTLDNOW | RTLDLOCAL에 전달되므로, 모델의 config.pbtxt에 영향을 줄 수 있는 사람은 누구나 모델 로드 시점에 Triton 서버 프로세스 내부에...

0

セキュリティ研究のための、オープンソースで自己進化するマルチモデルハーネス。 Swiss Applied AI & Cybersecurity Research Lab 0.security · ドキュメント · FoxGuard 私たちの研究成果を支えるハーネス。 ソフトウェアの最も深い層にある新規脆弱性を発見します。Linuxカーネルにおける研究を含む、私たちの 公開開示とアップストリーム修正をご覧ください。 はじめに エージェント向けドキュメント このプロンプトをコーディングエージェントにコピーしてください: https://0.security/harness/setup.md...

Prineo_RE

About PriPara internal name Prineo is an arcade rythm game developed by SynSophia. Goal The goal of this project was to reverse the model format of the arcade series in order to port exclusive characters to the newer version of the game on Nintendo Switch. Screenshots Some interesting screenshots...

CVE-2024-7339

CVE-2024-7339: Information Leak Vulnerability in DVR devices. Exploiter an Vulnerability detection and Exploitation tool for CVE-2024-7339 Information leak vulnerability in DVR Vulnerability Over 400,000+ devices which leaks information like product model, kernel version and etc. Installation...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...