8201 matches found
AMSS++ 信任管理问题漏洞
AMSS++ is a tool within the Amssplus office management support system. Version 4.7 of AMSS++ has a vulnerability related to trust management. This vulnerability stems from hardcoded credentials, which may allow attackers to bypass authentication and access administrator accounts...
3DP-MANAGER 信任管理问题漏洞
3DP-MANAGER is a proxy tool developed by DenPiligrim’s individual developers. Versions of 3DP-MANAGER 2.0.1 and earlier contained a vulnerability related to trust management. This vulnerability stemmed from the automatic creation of management accounts with known default credentials during the...
DataHub 信任管理问题漏洞
DataHub is a metadata platform for a modern data stack, open-sourced by the datahub-project. Versions of DataHub prior to 1.3.1.8 contained a vulnerability related to trust management. This vulnerability stemmed from the LDAP intake source being vulnerable to man-in-the-middle attacks carried out...
CVE-2026-25725: Trust Boundary Violation
Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json...
Detecting backdoored language models at scale
Today, we are releasing new research on detecting backdoors in open-weight language models. Our research highlights several key properties of language model backdoors, laying the groundwork for a practical scanner designed to detect backdoored models at scale and improve overall trust in AI...
AList 信任管理问题漏洞
AList is a file list program developed by Xhofe, a Chinese individual, that supports multiple storage methods. Versions of AList prior to 3.57.0 had vulnerabilities related to trust management. These vulnerabilities stemmed from the default disabling of TLS certificate verification, which could...
Cisco Prime Infrastructure 信任管理问题漏洞
Cisco Prime Infrastructure is an application software developed by the American company Cisco. It is used to simplify the management of wireless and wired networks. Cisco Prime Infrastructure has a trust management vulnerability, which stems from the improper validation of user inputs in the...
PT-2026-6023
Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A flaw in the Windows kernel driver ProcessMonitorDriver.sys allows any user-mode application with a handle to the device to terminate arbitrary processes, including protected system processe...
Netis E1+ 信任管理问题漏洞
Netis E1+ is a wireless signal amplifier developed by the Chinese company Netis. Version 1.2.32533 of Netis E1+ contains a vulnerability related to trust management. This vulnerability stems from the presence of a hardcoded root account, allowing attackers to access devices using predefined...
SUID_Trust_Exploiter
SU...
Toxic_Flow_Analysis_Framework_For_Agentic_AI
Toxic Flow Analysis TFA Framework A Secure-by-Design framew...
CVE-2026-24904
TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tlslistener.rs, TlsListener::listen peeks 1024 bytes and calls extractclientrandom.... If parsetlsplaintext fails for example, a fragmented/partial ClientHello split across TCP writes,...
CVE-2026-24902
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In tcpforwarder.rs, SSRF protection for allowprivatenetworkconnections = false was only applied in the TcpDestination::HostNamepeer path. The...
Okara: Detection and Attribution of TLS Man-In-The-Middle Vulnerabilities in Android Apps with Foundation Models
Transport Layer Security TLS is fundamental to secure online communication, yet vulnerabilities in certificate validation that enable Man-in-the-Middle MitM attacks remain a pervasive threat in Android apps. Existing detection tools are hampered by low-coverage UI interaction, costly...
Human-Centered Explainability in AI-Enhanced UI Security Interfaces: Designing Trustworthy Copilots for Cybersecurity Analysts
Artificial intelligence AI copilots are increasingly integrated into enterprise cybersecurity platforms to assist analysts in threat detection, triage, and remediation. However, the effectiveness of these systems depends not only on the accuracy of underlying models but also on the degree to whic...
CVE-2026-24904
TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tlslistener.rs, TlsListener::listen peeks 1024 bytes and calls extractclientrandom.... If parsetlsplaintext fails for example, a fragmented/partial ClientHello split across TCP writes,...
CVE-2026-24902 TrustTunnel has SSRF and private network restriction bypass via numeric address destinations
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In tcpforwarder.rs, SSRF protection for allowprivatenetworkconnections = false was only applied in the TcpDestination::HostNamepeer path. The...
CVE-2026-24904
TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tlslistener.rs, TlsListener::listen peeks 1024 bytes and calls extractclientrandom.... If parsetlsplaintext fails for example, a fragmented/partial ClientHello split across TCP writes,...
ThreatsDay Bulletin: New RCEs, Darknet Busts, Kernel Bugs & 25+ More Stories
This week's updates show how small changes can create real problems. Not loud incidents, but quiet shifts that are easy to miss until they add up. The kind that affects systems people rely on every day. Many of the stories point to the same trend: familiar tools being used in unexpected ways...