CVE-2025-53767

Azure OpenAI CVE-2025-53767 is an elevation-of-privilege vulnerability rated CVSS v3.1 base score 10 (NETWORK, LOW attack complexity, PR NONE, UI NONE, C:H/I:H/A:N, scope CHANGED). It affects Azure OpenAI and can grant elevated rights with no user interaction. Microsoft has published updates via ...

CVE-2025-53767 Azure OpenAI Elevation of Privilege Vulnerability

...

Azure OpenAI Elevation of Privilege Vulnerability

...

KLA86378 PE vulnerabilities in Microsoft Azure

An elevation of privilege vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure OpenAI can be exploited remotely to gain privileges. 2. A...

PT-2025-32313

Name of the Vulnerable Software and Affected Versions: Azure OpenAI affected versions not specified Description: An elevation of privilege issue exists in Azure OpenAI. Successful exploitation could allow an attacker to gain elevated privileges. Recommendations: At the moment, there is no...

Microsoft Azure Open AI 代码问题漏洞

Microsoft Azure Open AI is an artificial intelligence service from Microsoft Corporation USA. A code issue vulnerability exists in Microsoft Azure Open AI. An attacker can elevate privileges by exploiting the vulnerability...

A Single Poisoned Document Could Leak ‘Secret’ Data Via ChatGPT

Security researchers found a weakness in OpenAI’s Connectors, which let you hook up ChatGPT to other services, that allowed them to extract data from a Google Drive without any user interaction...

CVE-2025-7725

CVE-2025-7725 affects the WordPress plugin “Contest Gallery – Upload, Vote & Sell with PayPal and Stripe” (and related Photo/Contest Gallery suite). The vulnerability is a Stored Cross-Site Scripting (XSS) in the comment feature present in all versions up to and including 26.1.0, caused by insuff...

CVE-2025-7725 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to...

MAL-2025-6384 Malicious code in openai-tsp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9afad0907413b0e88664cb893d34b71ad10d4a15def77275bc4a654bb21dd7a8 The OpenSSF Package Analysis project identified 'openai-tsp' @ 16.1.0...

Malicious code in openai-tsp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9afad0907413b0e88664cb893d34b71ad10d4a15def77275bc4a654bb21dd7a8 The OpenSSF Package Analysis project identified 'openai-tsp' @ 16.1.0...

WordPress AI Engine Information Disclosure Vulnerability

WordPress AI Engine is a plugin based on OpenAI technology, which is mainly used to integrate artificial intelligence features into WordPress websites to improve the efficiency of content generation, automated operations and so on. WordPress AI Engine suffers from an information disclosure...

Malicious Package

Overview openai-fm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

Inclusion of Functionality from Untrusted Control Sphere

Overview @openai/codex is a OpenAI Codex CLI Lightweight coding agent that runs in your terminal Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to auto-approving ripgrep execution even when the --pre, --hostname-bin, --search-zip, ...

PT-2025-30717 · Openai +1 · Openai Codex Cli +1

Name of the Vulnerable Software and Affected Versions: OpenAI Codex CLI versions prior to 0.9.0 Description: The OpenAI Codex CLI application automatically approves the execution of ripgrep rg even when specific flags—--pre, --hostname-bin, --search-zip, or -z—are used. Recommendations: Update to...

CVE-2025-54558

OpenAI Codex CLI (prior to 0.9.0) is affected: the CLI auto-approves ripgrep (rg) execution even when --pre, --hostname-bin, --search-zip, or -z are used. This could enable unintended command execution via these flags. Remediation: upgrade to version 0.9.0 or later.

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

OpenAI Codex CLI 安全漏洞

OpenAI Codex CLI is an OpenAI open source lightweight coding agent software that runs in the terminal. A security vulnerability exists in OpenAI Codex CLI versions prior to 0.9.0 that stems from automatic approval of ripgrep execution, which could lead to a security risk...