Hackers Using New QuirkyLoader Malware to Spread Agent Tesla, AsyncRAT and Snake Keylogger

Cybersecurity researchers have disclosed details of a new malware loader called QuirkyLoader that's being used to deliver via email spam campaigns an array of next-stage payloads ranging from information stealers to remote access trojans since November 2024. Some of the notable malware families...

CVE-2025-6758

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imicagentregister' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticate...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

Agent Zero 安全漏洞

Agent Zero is an artificial intelligence framework by the individual developer Jan Tomášek. A security vulnerability exists in Agent Zero version v0.8, which stems from a directory traversal vulnerability in the /api/downloadworkdirfile.py component...

CVE-2025-55523

An issue in the component /api/downloadworkdirfile.py of Agent-Zero v0.8. allows attackers to execute a directory traversal...

PT-2025-34265

Name of the Vulnerable Software and Affected Versions: Agent-Zero versions 0.8.0 through 0.8.9 Description: An issue exists in the /api/download work dir file.py component that allows attackers to execute a directory traversal. Recommendations: At the moment, there is no information about a newer...

Agent Zero 安全漏洞

Agent Zero is an artificial intelligence framework by the individual developer Jan Tomášek. A security vulnerability exists in Agent Zero version v0.8, which stems from improper permissions and could lead to a system reset...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

PT-2025-34266

Name of the Vulnerable Software and Affected Versions: Agent-Zero versions 0.8.0 through 0.8.9 Description: Insecure permissions in Agent-Zero allow attackers to arbitrarily reset the system via unspecified vectors. Recommendations: At the moment, there is no information about a newer version tha...

CVE-2025-55523

An issue in the component /api/downloadworkdirfile.py of Agent-Zero v0.8. allows attackers to execute a directory traversal...

CVE-2025-55523

An issue in the component /api/downloadworkdirfile.py of Agent-Zero v0.8. allows attackers to execute a directory traversal...

CVE-2025-55523

Agent-Zero CVE-2025-55523 affects v0.8.0–0.9.4 and is caused by improper validation in /api/download_work_dir_file.py that enables a path traversal, allowing arbitrary file download via a crafted request. Impacts include access to unauthorized files. Remediation: update to the latest Agent-Zero v...

CVE-2025-55524

CVE-2025-55524 concerns Agent-Zero, versions 0.8.0 through 0.8.9 , where insecure permissions allow an attacker to arbitrarily reset the system via unspecified vectors. Root cause cited as improper permissions in Agent-Zero v0.8.*. Public docs do not specify a concrete vulnerable component, explo...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

Malicious code in ai-agent-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 81c9d8af77a711b63ca783f6e56fa2838866df6eb7feee32485fa94cb387c202 The OpenSSF Package Analysis project identified 'ai-agent-email' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41255 Malicious code in ai-agent-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 81c9d8af77a711b63ca783f6e56fa2838866df6eb7feee32485fa94cb387c202 The OpenSSF Package Analysis project identified 'ai-agent-email' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

How Agentic AI Helps with Adaptive Cloud Risk Assessment with Agent Vikram

In fast-moving cloud environments like AWS, security teams face an uncomfortable truth: not every EC2 instance is being scanned, existing tools don’t work across a diverse environment that includes long-lived and ephemeral assets, and visibility is never complete. Qualys research found that over...

Remote Code Execution (RCE)

github.com/1panel-dev/1panel is vulnerable to Remote Code Execution RCE. The vulnerability is due to incomplete certificate verification during HTTPS communication between the Core and Agent endpoints, which allows an attacker to gain unauthorized access and execute commands with high privileges...

CVE-2025-6758

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imicagentregister' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticate...

CVE-2025-6758 Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imicagentregister' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticate...