7026 matches found
MAL-2026-10722 Malicious code in @whalent/agent-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...
AI Can Find Bugs, But Human Knowledge Still Proves Them
Artificial intelligence AI is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive...
EUVD-2026-44893
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-12510
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions...
EUVD-2026-44870
The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browse...
A Bootiful Podcast: Russ Miles on Safer, More Productive Interactions with AI
I’m joined, I think, for the second time by my friend, the legendary architect and developer extraordinaire Russ Miles, who has given some of the most cerebral and exciting Spring keynotes and talks ever. And this time, he’s back to talk about — guess what — A.I. As usual, he’s got a different an...
Turning threat intelligence into decisive action with Defender Experts
In this article 1. Upstream: See the campaign before it reaches you 1. In your environment: Follow the threat everywhere it moves 2. See it live at Black Hat USA Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities,...
CVE-2026-57833
The CVE affects the Joomla extension 4Analytics for weeblr.com, with an unauthenticated stored XSS vulnerability in the AI analysis feature present in versions prior to 5.0.2. The underlying issue is a stored XSS in the AI analysis workflow, leading to high impact on confidentiality, integrity, a...
CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2
Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...
MAL-2026-10629 Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability
...
EUVD-2026-43547
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...
This Week in Spring - July 14th, 2026
This Week in Spring - July 14th, 2026 In two short months, on this date in September, Java 27 will be here! Who's excited? I'm excited! I'm in delightful Denver, CO, for the amazing UberConf. I just delivered a workshop that was scheduled from 09:00 to 17:00, but it went into overtime, and we jus...
CVE-2026-62328
Summary: CVE-2026-62328 affects 9Router up to version 0.4.41 and describes an unauthenticated information-disclosure vulnerability exposed via unprotected API endpoints. Attackers can remotely query the request-logs and request-details routes (which lack authentication middleware) to enumerate pa...
CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...
CVE-2026-6875
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
CERTFR-2026-CTI-004
creationtimestamp| type| source ---|---|--- 2026-07-13 09:25:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116911948082559856...
PT-2026-57852
Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description An unauthenticated remote code execution flaw exists in the ServiceNow AI Platform due to a server-side sandbox escape. The issue involves a novel attack chain utilizing...