osintnet-public

OsintNET ist eine browserbasierte OSINT-Plattform für Domain-Intelligence, Website-Risiko-Scans, SERP-Ermittlung, E-Mail- und Username-OSINT, Bild-Intelligence, Bildauthentizitätsprüfungen und KI-Bilderkennung. Webseite · OSINT-Tools · Beste OSINT-Tools · KI-OSINT-Tools · llms.txt · KI-Prompt-Map...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses keras-3.14.1, bcprov-jdk18on-1.84.jar, sentencetransformers-5.2.0-py3-none-any.whl, pillow-12.2.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, tomcat-embed-core-10.1.55.jar, langgraphsdk-0.3.13-py3-none-any.whl, and transformers-4.57.5-py3-none-any.whl which...

CVE-2026-74820

CVE-2026-74820 is a CRITICAL (CVSS 4.0: 10.0) SQL injection vulnerability in the ServiceNow AI platform , specifically through a Dynamic Schema ORDER BY clause . An unauthenticated user can, under certain circumstances, execute arbitrary SQL statements against the instance's underlying database, ...

EUVD-2026-67221

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

EUVD-2026-67220

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

CVE-2026-18886

CVE-2026-18886 is an improper access control vulnerability in the ServiceNow AI platform , specifically in the System Configuration Image Upload Processor . An unauthenticated user can, in certain circumstances, create or modify instance data beyond intended scope, leading to privilege escalation...

CVE-2026-18886 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

EUVD-2026-67219

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

CVE-2026-18885

CVE-2026-18885 is a code injection vulnerability in the ServiceNow AI platform , specifically in its GraphQL Composite Data API , enabling an unauthenticated attacker to execute arbitrary code and access or modify instance data. The CVSS 4.0 base score is 10.0 (Critical) with all impact dimension...

CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face

OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence AI-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident, the company said, took place during cybersecurity evaluations o...

CVE-2026-59319

Spring AI 2.0.0 is affected by a RediSearch tag injection in RedisChatMemoryRepository.findByMetadata(). The method builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike sibling methods (get(), clear(), findByTimeRange()) that...

CVE-2026-59319 RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

EUVD-2026-67200

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

CVE-2026-59294

Spring AI 's ResourceCacheService.getCacheName() builds an on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, before passing the result to new File(resourceParentFolder, newFileName). This allows an arbitrary file write via path traversal w...

EUVD-2026-67182

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...

CVE-2026-59294 Arbitrary File Write via Path Traversal in ResourceCacheService

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...

agentZ

AgentZ Piattaforma Agentica AI Zero Trust Costruisci, esegui e governa agenti AI. Sicura by design. Ogni agente viene eseguito all'interno di una sandbox con negazione predefinita e non riceve mai una credenziale. Ogni azione dell'agente è tracciabile. AgentZ è una piattaforma multi-tenant per...

CVE-2026-75871

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...