firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Core & HTML component...

firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the DOM: Device Interfaces component...

firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Core & HTML component...

xss

CSS Style Sheet Mutation alert"This is a test" alert"...

MINI-J8CX-25PC-X33V

Bulletin has no description...

mcp-stdio-exploit

MCP STDIO Exploit: A Local Reimplementation Vulnerability...

Dynamic Cyber Ranges

As LLM-driven agents advance in cybersecurity, Jeopardy CTF benchmarks are approaching saturation and cyber ranges, the natural next evaluation frontier, offer diminishing resistance under their current static design. We validate this observation by deploying an LLM-driven Advanced Persistent...

fmt.Sprintf Code Execution

The vulnerability of the fmt.Sprintf function in the AI server for applications based on BricksLL language models relates to the lack of protection for the SQL query structure when processing the keyId parameter. Exploiting this vulnerability allows an attacker to gain access to protected...

System-Aware Contextual Digital Twin for ICS Anomaly Diagnosis

Industrial Control Systems ICS integrate computing, physical processes, and communication to operate critical infrastructures such as power grids, water treatment plants, and oil and gas facilities. As ICS become increasingly targeted by cyberattacks, timely and reliable anomaly diagnosis is...

ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...

Jailbreaking Frontier Foundation Models through Intention Deception

Large vision-language models exhibit remarkable capability but remain highly susceptible to jailbreaking. Existing safety training approaches aim to have the model learn a refusal boundary between safe and unsafe, based on the user's intent. It has been found that this binary training regime ofte...

com.thecookiezen:archiledger-core (>=0.0.4, <=0.0.5), org.springframework.ai:spring-ai-starter-model-transformers (>=1.1.0-m1, <=1.1.4) potentially affected by CVE-2026-40979 via org.springframework.ai:spring-ai-autoconfigure-model-transformers (>=1.1.0-m1, <=1.1.4)

org.springframework.ai:spring-ai-autoconfigure-model-transformers MAVEN version =1.1.0-m1, =0.0.4, =1.1.0-m1, =1.1.4 Source cves: CVE-2026-40979 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16316420...

org.springframework.ai:spring-ai-starter-model-transformers (>=1.0.0-m7, <=1.0.5) potentially affected by CVE-2026-40979 via org.springframework.ai:spring-ai-autoconfigure-model-transformers (>=1.0.0-m7, <=1.0.5)

org.springframework.ai:spring-ai-autoconfigure-model-transformers MAVEN version =1.0.0-m7, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40979 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16316420...

PT-2026-35512

A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base url results in server-side request forgery. Remot...

Exploit for CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo'...

MINI-Q273-PX8M-R54V

Bulletin has no description...

Arbitrary Command Injection

Overview ssh-mcp is a MCP server exposing SSH control for Linux and Windows systems via Model Context Protocol. Affected versions of this package are vulnerable to Arbitrary Command Injection via the shell.write function. An attacker can execute arbitrary system commands by supplying crafted inpu...

Insufficiently Protected Credentials

Overview ssh-mcp is a MCP server exposing SSH control for Linux and Windows systems via Model Context Protocol. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the Command Line Handler component due to the storage of the credential in plaintext. An...

secops-ai-threat-analyzer

🛡️ SecOpsAI: Threat Analysis & Adaptive Security Engine An e...

Ollama is Vulnerable to Path Traversal

A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component Tensor Model Transfer Handler. The manipulation of the argument digest results in path traversal. The attack may be performed from remote...