LlamaFirewall: an Open Source Guardrail System for Building Secure AI Agents

Large language models LLMs have evolved from simple chatbots into autonomous agents capable of performing complex tasks such as editing production code, orchestrating workflows, and taking higher-stakes actions based on untrusted inputs like webpages and emails. These capabilities introduce new...

A Rusty Link in the AI Supply Chain: Detecting Evil Configurations in Model Repositories

Recent advancements in large language models LLMs have spurred the development of diverse AI applications from code generation and video editing to text generation; however, AI supply chains such as Hugging Face, which host pretrained models and their associated configuration files contributed by...

An Empirical Study on the Effectiveness of Large Language Models for Binary Code Understanding

Binary code analysis plays a pivotal role in the field of software security and is widely used in tasks such as software maintenance, malware detection, software vulnerability discovery, patch analysis, etc. However, unlike source code, reverse engineers face significant challenges in understandi...

[SECURITY] Fedora 40 Update: radare2-5.9.8-7.fc40

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild during routine threat hunting. Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated...

CVE-2024-11638

CVE-2024-11638 affects the WordPress plugin Gtbabel (versions before 6.6.9). Root cause: it does not verify that the URL to analyze is within the blog, enabling unauthenticated attackers to trigger requests that can capture a logged-in user’s cookies (e.g., admin). Impact: potential admin cookie ...

WordPress plugin Gtbabel 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

ch.acanda.maven:code-analysis-maven-plugin (>=0.1.0 <=1.6.1), com.eventoframework:evento-cli (>=ev1.4.1 <=ev1.15.5) +105 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-core (>=6.21.0 <=7.0.0)

net.sourceforge.pmd:pmd-core MAVEN version =6.21.0, =0.1.0, =ev1.4.1, =ev1.4.1, =2.17.0, =1.1.0, =1.0.2, =1.2.0, =0.18, =0.18, =0.18, =2.10.2, =2.6.1, =2.19.0 and more Source cves: CVE-2025-23215 Source advisory: OSV:GHSA-88M4-H43F-WX84...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0 <=1.6.1), net.sourceforge.pmd:pmd-cli (>=7.0.0 <=7.1.0) +1 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (=7.0.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-designer and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin =1.6.0, =7.0.0, =7.0.0, =7.1.0 Source cves:...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0 <=1.6.1), net.sourceforge.pmd:pmd-cli (>=7.0.0 <=7.1.0) +1 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (=7.0.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-designer and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin =1.6.0, =7.0.0, =7.0.0, =7.1.0 Source cves:...

CVE-2025-23215

PMD Designer’s release signing keys were found with passphrases exposed in Maven Central jars. The two compromised keys (94A5 2756 9CAF 7A47 AFCA BDE4 86D3 7ECA 8C2E 4C5B and EBB2 41A5 45CB 17C8 7FAC B2EB D0BF 1D73 7C9A 1C22) have been revoked; signatures on past artifacts remain valid, and the g...

The vulnerability of the Opigno CMS system’s module, related to errors in processing input data during syntax analysis of code, allows attackers to execute arbitrary code.

The vulnerability of the Opigno CMS system’s module is related to errors in data processing during syntax analysis of the code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-56828

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...

[SECURITY] Fedora 41 Update: radare2-5.9.8-4.fc41

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

MAL-2024-10697 Malicious code in code-analysis-shopee-ui-for-scf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8018baa56ec781ea13151a66ea8d0027c27ec76ea8fcc935bd8eff0e47343104 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 40 Update: radare2-5.9.6-1.fc40

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 41 Update: radare2-5.9.6-1.fc41

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 39 Update: radare2-5.9.6-1.fc39

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

llvm-toolset:rhel8 bug fix and enhancement update

An update is available for llvm-compat, lld, compiler-rt, module.lld, lldb, python-lit, module.python-lit, module.lldb, llvm, libomp, module.compiler-rt, clang, module.libomp, module.llvm-compat, module.llvm, module.clang. This update affects Rocky Linux 8. A Common Vulnerability Scoring System...

CVE-2024-48538

CVE-2024-48538 affects Neye3C v4.5.2.0, where incorrect access control during firmware update and download enables an attacker to access sensitive information by inspecting code/data inside the APK. Root cause is improper access control in the update/download workflow; impact is exposure of confi...