8518 matches found
VMware Spring AI 安全漏洞
VMware Spring AI is a development framework created by VMware Corporation in the Spring ecosystem, which integrates artificial intelligence and large language model capabilities. VMware Spring AI has a security vulnerability. This vulnerability allows malicious users to manipulate the behavior of...
AI Playground Software Advisory
Summary: A potential security vulnerability for some AI Playground software maintained by Intel may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-36515 Description: Uncontrolled search path for...
athina (1.1.0), atlas-mcp (0.1.0) +76 more potentially affected by CVE-2026-45758 via guardrails-ai (>=0.3.3, <=0.11.0)
guardrails-ai PYPI version =0.3.3, =0.1.39, =0.1.0, =0.1.0, =0.3.1, =0.0.2, =0.1.0, =0.1.0, =0.1.6, =0.0.6, =0.1.1a1 - guardrails-ai-detect-prompt-injection 0.2.1a1 and more Source cves: CVE-2026-45758 Source advisory: SNYK:PYTHON-GUARDRAILSAI-16641086...
CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints plugin/AI/receiveAsync.json.php and objects/EpgParser.php in AVideo call isSSRFSafeURL to validate user-supplied URLs, then fetch them using bare filegetcontents without disabling PHP's automatic...
CVE-2026-42856
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. ...
CVE-2026-42856 Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. ...
Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.3 (CUDA)
Red Hat AI Inference Server 3.3.3 CUDA is now available. Red Hat® AI Inference Server...
Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.3 (ROCm)
Red Hat AI Inference Server 3.3.3 ROCm is now available. Red Hat® AI Inference Server...
Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.3 (CUDA)
Red Hat AI Inference Server Model Optimization Tools 3.3.3 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...
Bringing AI Code Security into Qualys ETM
A first-class data model for the next generation of findings AI-driven code security is becoming a real category. Anthropic's Claude Code Security and OpenAI's Codex Security are the leading examples, and more will follow. These tools reason about source code at a depth that traditional SAST cann...
A week in security (May 4 – May 10)
Last week on Malwarebytes Labs: Microsoft says Edge’s plaintext password behavior is "by design" ShinyHunters escalates Canvas attacks with school login defacements Massive AI investment scam network spans 15,500 domains If a fake moustache can fool age checks, is the Online Safety Act working?...
Context-Aware Spear Phishing: Generative AI-Enabled Attacks against Individuals Via Public Social Media Data
We demonstrate how publicly available social-media data and generative AI GenAI can be misused to automate and scale highly personalized, context-aware spear-phishing campaigns. With minimal attacker effort, a small amount of public activity per target is sufficient for GenAI models to extract...
Network-AI 访问控制错误漏洞
Network-AI is a multi-agent orchestration and governance tool developed by Jovan Marinovic. Versions prior to Network-AI 5.1.3 contained an access control vulnerability. This vulnerability stemmed from the lack of authentication, session, source, or token checks for JSON-RPC tool calls transmitte...
MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study
LLMs are increasingly deployed as autonomous agents with access to tools, databases, and external services, yet practitioners across different sectors lack systematic methods to assess how known threat classes translate into concrete risks within a specific agentic deployment. We present MATRA, a...
CyberThreat-Nlp-Intelligence-System
🛡️ CyberGuard AI — Cyber Threat Intelligence System An AI-p...
Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments
Tool-enabled AI agents are increasingly deployed in cloud-hosted environments and offered as services, where they perform side-effecting operations through privileged tools within execution environments. While such agents enable powerful automation, the security implications of hosting autonomous...
Governing AI-Assisted Security Operations: A Design Science Framework for Operational Decision Support
Engineering managers increasingly must decide how to introduce generative artificial intelligence AI, retrieval-augmented generation, and coding agents into high-risk operational functions without weakening accountability, privacy, cost discipline, or auditability. The central message of this stu...
Strategic Commitments Shape Collective Cybersecurity under AI Inequality
The growing integration of AI into cybersecurity is reshaping the balance between attackers and defenders. When access to advanced AI-enabled defence tools is uneven, resource-limited defenders may be unable to adopt effective protection, creating persistent system vulnerabilities. We study the...
