Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Copilot allows an unauthorized attacker to disclose information over a network...

PT-2025-41487

Name of the Vulnerable Software and Affected Versions Copilot affected versions not specified Description A spoofing issue exists in Copilot. This allows for potential misrepresentation or impersonation within the Copilot environment. Recommendations At the moment, there is no information about a...

PT-2025-41484

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description A spoofing issue exists in Microsoft 365 Copilot. The vulnerability allows for potential misrepresentation of Copilot’s responses, potentially leading to user confusion or...

Microsoft 365 Word Copilot 命令注入漏洞

Microsoft 365 Word Copilot is an AI assistant from Microsoft Corporation, USA. Microsoft 365 Word Copilot has a spoofing vulnerability that can be exploited by attackers to cause spoofing attacks...

Microsoft 365 Copilot Business Chat 命令注入漏洞

Microsoft 365 Copilot Business Chat is an AI chat software from Microsoft Corporation, USA. Microsoft 365 Copilot Business Chat has a spoofing vulnerability that can be exploited by attackers to cause spoofing attacks...

PT-2025-41486

Name of the Vulnerable Software and Affected Versions Copilot affected versions not specified Description A spoofing issue exists within Copilot. The vulnerability allows for potential manipulation of Copilot’s responses. Recommendations At the moment, there is no information about a newer versio...

Microsoft 365 Copilot Business Chat 命令注入漏洞

Microsoft 365 Copilot Business Chat is an AI chat software from Microsoft Corporation, USA. Microsoft 365 Copilot Business Chat has a spoofing vulnerability that can be exploited by attackers to cause spoofing attacks...

EUVD-2000-0282

Malware in sbrugna...

EUVD-2025-23956

Malicious code in bioql PyPI...

EUVD-2024-37173

Malicious code in bioql PyPI...

EUVD-2024-40359

Malicious code in bioql PyPI...

EUVD-2024-43909

Malicious code in bioql PyPI...

EUVD-2025-18114

Malicious code in bioql PyPI...

EUVD-2025-24366

Malicious code in bioql PyPI...

Empowering defenders in the era of agentic AI with Microsoft Sentinel

Microsoft unveils a new wave of security innovation—delivering an agentic platform to protect organizations at scale We are living through a turning point in how organizations work and defend themselves. Across industries, “Frontier Firms” are emerging; these are businesses where humans and AI...

Microsoft Expands Sentinel Into Agentic Security Platform With Unified Data Lake

Microsoft on Tuesday unveiled the expansion of its Sentinel Security Incidents and Event Management solution SIEM as a unified agentic platform with the general availability of the Sentinel data lake. In addition, the tech giant said it's also releasing a public preview of Sentinel Graph and...

Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives

October marks Cybersecurity Awareness Month, a time when the developer community reflect on the importance of security in the evolving digital landscape. At GitHub, we understand that protecting the global software ecosystem relies on the commitment, skill, and ingenuity of the security research...

GitHub's Copilot Code Review: Can AI Spot Security Flaws Before You Commit?

As software development practices increasingly adopt AI-powered tools, ensuring that such tools can support secure coding has become critical. This study evaluates the effectiveness of GitHub Copilot's recently introduced code review feature in detecting security vulnerabilities. Using a curated...

EchoLeak: the First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Large language model LLM assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources. This paper presents an in-depth case study of EchoLeak CVE-2025-32711, a zero-click prompt injection vulnerability in Microso...

Obsidian GitHub Copilot Plugin stores sensitive information in cleartext

Overview Obsidian GitHub Copilot Plugin provided by Pierre-Adrien Vasseur is vulnerable to the following vulnerability. Cleartext storage of sensitive information CWE-312 - CVE-2025-58401 Rui Nakajima reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...