22 matches found
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without...
CVE-2026-43995
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...
CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...
CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...
dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +40 more potentially affected by CVE-2026-0771 via lfx (>=0.1.13, <=1.13.0.dev33)
lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.4 - lfx-confluent 0.1.0 - lfx-darkmoon 0.1.0 and more Source cves: CVE-2026-0771 Source advisory: SNYK:PYTHON-LFX-15091580...
EUVD-2025-21457
Malicious code in bioql PyPI...
CVE-2025-50819
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...
CVE-2025-50819
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...
CVE-2025-50819
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...
arxiv-daily 路径遍历漏洞
arxiv-daily is an automated paper updater for OMAR Individual Developers. A security vulnerability exists in arxiv-daily version 2025-05-06, which stems from a directory traversal vulnerability when parsing the topic.yml file...
PT-2025-29568 · Unknown · Beiyuouo Arxiv-Daily
Name of the Vulnerable Software and Affected Versions: beiyuouo arxiv-daily versions through 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 Description: A directory traversal vulnerability exists when parsing the topic.yml file in the generation logic within daily arxiv.py...
CVE-2025-50819: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...
CVE-2025-50819
A directory traversal vulnerability exists in beiyuouo arxiv-daily versions up to and including 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687). The flaw occurs during the parsing of the topic.yml file within the generation logic located in daily_arxiv.py. This vulnerability allows a...
CVE-2025-50819
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...
Expected Behavior Violation
Overview llama-index-readers-papers is a llama-index readers papers integration Affected versions of this package are vulnerable to Expected Behavior Violation via the ArxivReader process. An attacker can cause data loss by uploading papers with identical titles but different contents, resulting ...
PYSEC-2025-247
A vulnerability in the ArxivReader class of the run-llama/llamaindex repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each othe...
LlamaIndex 安全漏洞
LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex 0.12.22.post1 and earlier versions, which stems from an MD5 hash conflict when generating filenames in the ArxivReader class, which could lead to data loss...
CVE-2024-12392
A Server-Side Request Forgery SSRF vulnerability exists in binary-husky/gptacademic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the application access any URL,...
CVE-2024-10986
GPT Academic version 3.83 is vulnerable to a Local File Read LFI vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks...