LoRAShield: Data-Free Editing Alignment for Secure Personalized LoRA Sharing

The proliferation of Low-Rank Adaptation LoRA models has democratized personalized text-to-image generation, enabling users to share lightweight models e.g., personal portraits on platforms like Civitai and Liblib. However, this "share-and-play" ecosystem introduces critical risks: benign LoRAs c...

SecureT2I: No More Unauthorized Manipulation on AI Generated Images from Prompts

Text-guided image manipulation with diffusion models enables flexible and precise editing based on prompts, but raises ethical and copyright concerns due to potential unauthorized modifications. To address this, we propose SecureT2I, a secure framework designed to prevent unauthorized editing in...

CVE-2025-53368

Citizen is a MediaWiki skin. CVE-2025-53368 affects Citizen versions 1.9.4 up to, but not including, 3.4.0, where page descriptions are inserted into raw HTML without sanitization when using the legacy search bar. This enables stored XSS by any user with page editing privileges targeting other us...

A message from Bruce the mechanical shark

Welcome to this week's edition of the Threat Source newsletter. Hi, I'm Bruce, the 25-foot mechanical star of "Jaws." This summer marks 50 years since my 4 minutes of screentime kept people out of the water for decades. Maybe this Fourth of July weekend you're planning to sea-shanty your way to a...

PT-2025-27830 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: Citizen MediaWiki skin versions 1.9.4 through 3.4.0 Description: The Citizen MediaWiki skin has an issue where page descriptions are inserted into raw HTML without proper sanitization when using the old search bar. This allows any user with...

CVE-2025-53211

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through = 2.2.3...

GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter user-supplied text for the GLightbox Javascript library leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Important: Red Hat Security Advisory: gimp security update

An update for gimp is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : gimp (RHSA-2025:9316)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9316 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

SAP Manage Processing Rules Authorization Issues Vulnerability

SAP is enterprise applications, enterprise resource management applications, supply chain management applications, procurement applications, travel and expense management software. An authorization issue vulnerability exists in SAP Manage Processing Rules, which stems from insufficient...

EditLord: Learning Code Transformation Rules for Code Editing

Code editing is a foundational task in software development, where its effectiveness depends on whether it introduces desired code property changes without changing the original code's intended functionality. Existing approaches often formulate code editing as an implicit end-to-end task, omittin...

Important: gimp:2.8 security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: Multiple...

Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: Multiple...

XWiki does not require right warnings for notification displayer objects

Impact When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification...

XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

Impact When a user without script right creates a document with an XWiki.Notifications.Code.NotificationEmailRendererClass object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as whi...

CVE-2025-49585

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...

CVE-2025-49587 XWiki does not require right warnings for notification displayer objects

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing X...

CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...

CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...

CVE-2025-49586

XWiki is affected by CVE-2025-49586, a remote code execution (RCE) vulnerability in which any user with edit rights on at least one App Within Minutes application can obtain programming rights and execute code by editing the application. The flaw is fixed in XWiki releases 17.0.0, 16.4.7, and 16....