8766 matches found
CVE-2025-4767 defog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injection
A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function testcustomtool of the file introspect/backend/integrationroutes.py of the component Test Endpoint. The manipulation of the argument inputmodel leads to code injectio...
CVE-2025-4767
CVE-2025-4767 affects defog-ai introspect up to version 0.1.4. The vulnerability targets the Test Endpoint’s test_custom_tool function, where improper handling of the input_model in introspect/backend/integration_routes.py enables code injection. Local attack required; exploit has been disclosed ...
CVE-2025-4767 defog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injection
A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function testcustomtool of the file introspect/backend/integrationroutes.py of the component Test Endpoint. The manipulation of the argument inputmodel leads to code injectio...
MAL-2025-3905 Malicious code in meta-ai-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in meta-ai-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Nosy Layers, Noisy Fixes: Tackling DRAs in Federated Learning Systems Using Explainable AI
Federated Learning FL has emerged as a powerful paradigm for collaborative model training while keeping client data decentralized and private. However, it is vulnerable to Data Reconstruction Attacks DRA such as "LoKI" and "Robbing the Fed", where malicious models sent from the server to the clie...
PT-2025-21630 · Unknown · Defog-Ai Introspect
Name of the Vulnerable Software and Affected Versions: defog-ai introspect versions up to 0.1.4 Description: A critical issue affects the function test custom tool of the file introspect/backend/integration routes.py of the component Test Endpoint. The manipulation of the argument input model lea...
PT-2025-21735 · Unknown · Berthaai Bertha Ai
Name of the Vulnerable Software and Affected Versions: berthaai BERTHA AI versions 1.12.11 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...
CVE-2025-0329
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-0329
The CVE-2025-0329 entry concerns the AI ChatBot for WordPress (WPBot) plugin for WordPress, affected versions prior to 6.2.4. The root cause is insufficient sanitization and escaping of certain settings, which could enable stored cross-site scripting (XSS) by high-privilege users (e.g., admins), ...
CVE-2025-0329 AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-0329 AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Noyb Threatens Meta with Lawsuit for Violating GDPR to Train AI on E.U. User Data From May 27
Austrian privacy non-profit noyb none of your business has sent Meta's Irish headquarters a cease-and-desist letter, threatening the company with a class action lawsuit if it proceeds with its plans to train users' data for training its artificial intelligence AI models without an explicit opt-in...
AI-Generated Law
On April 14, Dubai's ruler, Sheikh Mohammed bin Rashid Al Maktoum, announced that the United Arab Emirates would begin using artificial intelligence to help write its laws. A new Regulatory Intelligence Office would use the technology to "regularly suggest updates" to the law and "accelerate the...
Malicious code in ai_challenge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cac3284458d7620929c88bceb52c6a1050042e2974e32bf76827af876c55b4be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3814 Malicious code in ai_challenge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cac3284458d7620929c88bceb52c6a1050042e2974e32bf76827af876c55b4be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2025-21555 · WordPress · Ai Chatbot
Name of the Vulnerable Software and Affected Versions: AI ChatBot for WordPress versions prior to 6.2.4 Description: The issue concerns the AI ChatBot for WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as...
CVE-2025-47777 5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution RCE via unsafe...
GenAI Security: Outsmarting the Bots with a Proactive Testing Framework
The increasing sophistication and integration of Generative AI GenAI models into diverse applications introduce new security challenges that traditional methods struggle to address. This research explores the critical need for proactive security measures to mitigate the risks associated with...
