20108 matches found
CVE-2026-2999 Changing｜IDExpert Windows Logon Agent - Remote Code Execution
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them...
CVE-2026-2999
CVE-2026-2999 affects IDExpert Windows Logon Agent by Changing. Described vulnerability: unauthenticated remote RCE that enables forcing the system to download and execute arbitrary executables from a remote source. The provided documents do not specify affected versions, root cause details beyon...
CVE-2026-2999 Changing｜IDExpert Windows Logon Agent - Remote Code Execution
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them...
EUVD-2026-9146
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them...
PT-2026-22547
Name of the Vulnerable Software and Affected Versions IDExpert Windows Logon Agent affected versions not specified Description IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution issue. Unauthenticated remote attackers can force the system to download arbitrary DLL file...
PT-2026-22697
Name of the Vulnerable Software and Affected Versions ModelScope ms-agent versions prior to v1.6.0rc1 Description A command injection issue exists in the ModelScope ms-agent framework, specifically within the Shell tool, due to improper input sanitization. The regular expression-based blacklist...
PT-2026-22706
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to se...
Sim Studio 安全漏洞
Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from authorization checks bypassed in the/api/auth/oauth/token endpoint, which could allow unverified attackers ...
Extending the Formalism and Theoretical Foundations of Cryptography to AI
Recent progress in Large Language Models LMs has enabled the development of autonomous LM-based agents capable of executing complex tasks with minimal supervision. These agents have started to be integrated into systems with significant autonomy and authority. The security community has been...
Changing IDExpert Windows Logon Agent 安全漏洞
Changing IDExpert Windows Logon Agent is an identity authentication client software developed by Changing, a company based in Taiwan, China. This software is designed to enhance security during Windows login processes. Changing IDExpert Windows Logon Agent contains a security vulnerability that...
MS-Agent 安全漏洞
MS-Agent is an open-source personal assistant framework developed by ModelScope. Versions of MS-Agent prior to v1.6.0rc1 contained security vulnerabilities. These vulnerabilities stemmed from specially crafted prompt inputs that could lead to command injection, allowing execution of arbitrary...
PT-2026-42471
Name of the Vulnerable Software and Affected Versions Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Description An origin validation issue in the Apex One/SEP agent allows a local attacker to escalate privileges. This flaw...
Changing IDExpert Windows Logon Agent 安全漏洞
Changing IDExpert Windows Logon Agent is an identity authentication client software developed by Changing, a company based in Taiwan, China. This software is designed to enhance security during Windows login processes. Changing IDExpert Windows Logon Agent contains a security vulnerability that...
MS-Agent does not properly sanitize commands sent to its shell tool, allowing for RCE
Overview A command injection vulnerability was identified in the MS-Agent framework that can be triggered through unsanitized prompt-derived input. An attacker can craft untrusted input introduced via a chat prompt or other external content sources, resulting in arbitrary command execution on the...
AWE: Adaptive Agents for Dynamic Web Penetration Testing
Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating software velocity and the limited adaptability of existing security tooling. Pattern-driven scanners fail to reason about novel contexts,...
A Systematic Study of LLM-Based Architectures for Automated Patching
Large language models LLMs have shown promise for automated patching, but their effectiveness depends strongly on how they are integrated into patching systems. While prior work explores prompting strategies and individual agent designs, the field lacks a systematic comparison of patching...
Quantifying Frontier LLM Capabilities for Container Sandbox Escape
Large language models LLMs increasingly act as autonomous agents, using tools to execute code, read and write files, and access networks, creating novel security risks. To mitigate these risks, agents are commonly deployed and evaluated in isolated "sandbox" environments, often implemented using...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: k8sgateway, aws-node-termination-handler-fips, tflint, cert-manager-webhook-pdns, sftpgo-plugin-pubsub, zarf, seaweedfs, kubevela-fips, kubernetes-csi-external-resizer, cert-manager-webhook-pdns-fips, cortex-fips, kubevela, teleport, percona-server-mongodb-operator,...
ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence AI agent and take over control. "Our vulnerability lives in the core system itself – no plugins, no marketplace, no...
