Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load

tractnnef::tensors::readtensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes both the element count productshape and the byte allocation productshape sizeofdt with unchecked usize arithmetic. In release builds no overflow-checks both products wrap modulo 2^64. A...

MINI-777W-PHRM-H39P

Bulletin has no description...

MINI-498V-4572-P6XH

Bulletin has no description...

Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model

Analysis tools do not need AI built in to support agentic workflows; they simply need to expose their data through an external scripting interface. Even traditional graphical user interface GUI applications can be made AI-accessible by publishing their internal object models, allowing agents to...

MINI-3V64-X455-GF8Q

Bulletin has no description...

MINI-PC2F-7R2X-XPWV

Bulletin has no description...

MINI-W979-763G-Q64J

Bulletin has no description...

MINI-934W-4MGC-X6H6

Bulletin has no description...

MINI-843V-PC77-W377

Bulletin has no description...

MINI-WX78-HX3G-MVW3

Bulletin has no description...

Artificial Intelligence As Game Changer in Cybersecurity: What We Learned in 2025-2026, and How This Is Relevant for Africa

In 2025 and 2026, two events settled questions that had until then been speculative. In the first, a large language model executed the great majority of a state-aligned cyber-espionage campaign on its own, with human operators intervening at only a few decision points. In the second, the most...

PT-2026-50795

Name of the Vulnerable Software and Affected Versions mcp-pinot versions prior to 3.1.0 Description mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. The software defaults to running an HTTP MCP server bound to 0.0.0.0:8080 without authentication. Th...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40257)

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcppmdeladdtimer mptcppmdeladdtimer can call skstoptimersyncsk, &entry-addtimer while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusin...

Analyzing Defensive Misdirection against Model-Guided Automated Attacks on Agentic AI Systems

Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents. These capabilities make prompt-injection and jailbreak attacks more consequential, especially as attackers adopt model-guided...

PT-2026-50702

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the Permission Model enforcement allows a bypass through path misvalidation in the process.report.writeReport function. This issue can result in a confidentiality...

Siemens RUGGEDCOM RST2428P Cross-site Scripting (CVE-2026-22610)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting XSS vulnerability has been identified in the Angular Template Compiler. The...

MINI-RJ49-58PP-962X

Bulletin has no description...

MINI-M265-R589-4JR3

Bulletin has no description...

MINI-5V2M-WFC4-PWHP

Bulletin has no description...

CVE-2026-12315

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...