CVE-2025-53536

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with...

GHSA-4VC8-WVHW-M5GV Juju allows arbitrary executable uploads via authenticated endpoint without authorization

Summary You can affect the agent binaries used in a Juju controller and the code that is run in the binaries by simply having a user account on a controller. You aren't required to have a model or any permissions. This just requires a user account in the controller database. Details Because of th...

CVE-2025-24508

Extraction of Account Connectivity Credentials ACCs from the IT Management Agent secure storage...

The vulnerability of the software tool for collecting network performance and Cisco ThousandEyes Endpoint Agent application data on Windows operating systems arises from incorrect path name restrictions for restricted access directories. This allows attackers to delete any files they desire.

The vulnerability of the software tool for collecting network performance data and the Cisco ThousandEyes Endpoint Agent for Windows operating systems is related to an incorrect path limitation in the access control list. Exploiting this vulnerability could allow a malicious individual to delete...

itsourcecode Insurance Management System 注入漏洞

itsourcecode Insurance Management System is itsourcecode open source insurance management system. An injection vulnerability exists in version 1.0 of itsourcecode Insurance Management System, which stems from SQL injection in the agentid parameter of the insertAgent.php file...

AI Agent Smart Contract Exploit Generation

We present A1, an agentic execution driven system that transforms any LLM into an end-to-end exploit generator. A1 has no hand-crafted heuristics and provides the agent with six domain-specific tools that enable autonomous vulnerability discovery. The agent can flexibly leverage these tools to...

CVE-2025-6759

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

CVE-2025-6759

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

CVE-2025-6759 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

CVE-2025-6759

CVE-2025-6759 affects Citrix Virtual Apps and Desktops — specifically the Windows Virtual Delivery Agent (VDA) used by CVAD and Citrix DaaS. The root cause is an open process handle with full access leaking from SYSTEM-owned GfxMgr.exe into a less-privileged processCtxGfx.exe, allowing a low-priv...

CVE-2025-6759

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

CVE-2025-6759 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in Azure Service Fabric and Monitor Agent. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges or to execute arbitrary code. Service Fabric: |----------------|------|-------------------------------------| | CVE ID | CVSS...

CVE-2025-47988

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-47988

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-47988 Azure Monitor Agent Remote Code Execution Vulnerability

...

CVE-2025-47988

Azure Monitor Agent (Microsoft) is vulnerable to CVE-2025-47988 due to improper control of code generation, enabling remote code execution over an adjacent network. Connected sources confirm affected versions are older than 1.35.1 and describe the issue as remote code execution via code injection...

Azure Monitor Agent Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network...

Windows Virtual Delivery Agent for CVAD and Citrix DaaS Security Bulletin CVE-2025-6759

Severity - High Description of Problem A vulnerability has been identified that impacts Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS. Affected Versions: The vulnerability affects the following supported versions of Windows Virtual Delivery Agent for...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent

Summary Vulnerabilities in IBM SDK Java Technology Edition that is shipped as part of agent framework in ITCAM for Applications WebSphere MQ Monitoring Agent. CVEs: CVE-2023-21830, CVE-2023-33850, CVE-2025-4447. Vulnerability Details CVEID:CVE-2023-21830 DESCRIPTION: An unspecified vulnerability ...