CVE-2024-9308: URL Redirection to Untrusted Site

An open redirect vulnerability in haotian-liu/llava version v1.2.0 LLaVA-1.6 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

CVE-2024-10908: URL Redirection to Untrusted Site

An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

FastChat 输入验证错误漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. An input validation error vulnerability exists in FastChat version v0.2.36, which stems from an open redirection vulnerability that could lead to phishing attacks, malware...

CVE-2024-11044: URL Redirection to Untrusted Site

An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user...

GPT Academic 输入验证错误漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from an open redirection vulnerability that originates from a user redirecting to a URL specified by the user-controlled file parameter without proper validation o...

URL Parsing Issue

Repository: Hugging Face Transformers File: imageutils.py Line: 834 Code Snippet: if video.startswith"https://www.youtube.com" or video.startswith"http://www.youtube.com": Vulnerability Description: The current implementation checks if a video URL starts with "https://www.youtube.com" or...

CVE-2025-29783

CVE-2025-29783 affects vLLM when Mooncake is configured for KV distribution across distributed hosts. The root cause is unsafe deserialization via pickle in the mooncake_pipe path exposed over ZMQ/TCP on all network interfaces, allowing remote code execution on affected distributed hosts. Public ...

MAL-2025-2591 Malicious code in blackspammerbd-remot1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 3618dd14b1eb36d5025d6a47cf69fbe08f06fa02c9de8338f7ca67ce5ef38fd9 This package is designed for remote control and data exfiltration, and could be used for malicious purposes such as spying, unauthorized access,...

Hackers Hide VenomRAT Malware Inside Virtual Hard Disk Image File

Hackers are using .VHD files to spread VenomRAT malware, bypassing security software, reveals Forcepoint X-Labs. Learn how this stealthy attack works and how to protect yourself...

ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers

The threat actors behind the ClearFake campaign are using fake reCAPTCHA or Cloudflare Turnstile verifications as lures to trick users into downloading malware such as Lumma Stealer and Vidar Stealer. ClearFake, first highlighted in July 2023, is the name given to a threat activity cluster that...

PT-2025-28155

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions prior to 4.52.1 Description: Hugging Face Transformers is affected by an improper input validation vulnerability in the image utils.py file. The vulnerability stems from insecure URL validation using the...

RLSA-2024:9474 Important: krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

thunderbird: Downloading of OpenPGP keys from WKD used incorrect padding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When requesting an OpenPGP key from a WKD server, an incorrect padding size was used, and a network observer could have learned the length of the requested email address...

thunderbird: Downloading of OpenPGP keys from WKD used incorrect padding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When requesting an OpenPGP key from a WKD server, an incorrect padding size was used, and a network observer could have learned the length of the requested email address...

CVE-2025-27593 RCE due to Device Driver

The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems...

TP-Link Router Botnet

There is a new botnet that is infecting TP-Link routers: The botnet can lead to command injection which then makes remote code execution RCE possible so that the malware can spread itself across the internet automatically. This high severity security flaw tracked as CVE-2023-1389 has also been us...

Moderate: krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

World Writable Directory in /var/log/below Allows Local Privilege Escalation

Below is a tool for recording and displaying system data like hardware utilization and cgroup information on Linux. Symlink Attack in /var/log/below/errorroot.log Below's systemd service runs with full root privileges. It attempts to create a world-writable directory in /var/log/below. Even if th...

Incident response analyst report 2024

Kaspersky provides rapid and fully informed incident response services to organizations, ensuring impact analysis and effective remediation. Our annual report shares anonymized data about the investigations carried out by the Kaspersky Global Emergency Response Team GERT, as well as statistics an...

Eclipse Cyclone DDS 安全漏洞

Eclipse Cyclone DDS is a very high performance and robust open source DDS implementation from the Eclipse Foundation. A security vulnerability exists in Eclipse Cyclone DDS versions prior to 0.10.5, which originates from an integer overflow during deserialization and could lead to an...