OBLIVIATE: Robust and Practical Machine Unlearning for Large Language Models

Large language models LLMs trained over extensive corpora risk memorizing sensitive, copyrighted, or toxic content. To address this, we propose OBLIVIATE, a robust unlearning framework that removes targeted data while preserving model utility. The framework follows a structured process: extractin...

PT-2025-20173 · Unknown · Syed Balkhi Beacon Lead Magnets/Lead Capture

Name of the Vulnerable Software and Affected Versions: Syed Balkhi Beacon Lead Magnets and Lead Capture versions 1.5.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross-Site Request Forgery. This means an attacker can trick a user...

Moodle Cross-Site Request Forgery Vulnerability (CNVD-2025-09236)

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from the lack of an anti-cross-site request forgery...

About Remote Code Execution & Arbitrary File Reading – Apache HTTP Server (CVE-2024-38475) vulnerability

About Remote Code Execution & Arbitrary File Reading - Apache HTTP Server CVE-2024-38475 vulnerability. Improper escaping of output in modrewrite module leads to remote code execution or arbitrary file reading. Successful exploitation does not require authentication. Apache HTTP Server 2.4.60,...

Insufficient Session Expiration

@auth0/nextjs-auth0 is vulnerable to Insufficient Session Expiration. The vulnerability is due to missing expiration claim due to not invoking .setExpirationTime when generating JWE tokens, allowing tokens to remain valid beyond intended session duration...

ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)

Exploit Title: ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery CSRF Google Dork: inurl:"/api/method/frappe" Date: 2025-04-29 Exploit Author: Ahmed Thaiban Thvt0ne Vendor Homepage: https://erpnext.com Software Link: https://github.com/frappe/erpnext Version: Delete User Click Her...

Capability-Based Multi-Tenant Access Management in Crowdsourced Drone Services

We propose a capability-based access control method that leverages OAuth 2.0 and Verifiable Credentials VCs to share resources in crowdsourced drone services. VCs securely encode claims about entities, offering flexibility. However, standardized protocols for VCs are lacking, limiting their...

Spill the Beans: Exploiting CPU Cache Side-Channels to Leak Tokens from Large Language Models

Side-channel attacks on shared hardware resources increasingly threaten confidentiality, especially with the rise of Large Language Models LLMs. In this work, we introduce Spill The Beans, a novel application of cache side-channels to leak tokens generated by an LLM. By co-locating an attack...

goTenna V1 安全漏洞

goTenna V1 is a portable offline communication device from goTenna, Inc. that enables long-distance peer-to-peer communication between smartphones via mesh network technology. A security vulnerability exists in goTenna V1, which originates from hard-coded authentication tokens, which could lead t...

HoneyWin: High-Interaction Windows Honeypot in Enterprise Environment

Windows operating systems OS are ubiquitous in enterprise Information Technology IT and operational technology OT environments. Due to their widespread adoption and known vulnerabilities, they are often the primary targets of malware and ransomware attacks. With 93% of the ransomware targeting...

goTenna Mesh 安全漏洞

goTenna Mesh is a portable mesh networking device from goTenna that builds decentralized communication networks through intelligent routing algorithms and supports offline transmission of text/location/emergency signals from smartphones. A security vulnerability exists in goTenna Mesh that stems...

PYSEC-2025-178

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the external flag on/off and change...

Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens (CVE-2022-22412)

Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens CVE-2022-22412 Vulnerability Details CVEID:CVE-2022-22412 DESCRIPTION: IBM Robotic Process Automation could allow a user with access to the local host client machine to obtain a login...

Important: runfinch-finch

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consist...

nextjs-auth0 代码问题漏洞

nextjs-auth0 is an Auth0 open source Next.js SDK for logging in using Auth0. A code issue vulnerability exists in versions of nextjs-auth0 prior to 4.0.1 through 4.5.1, which stems from not setting an expiration time when generating JWE tokens...

Important: docker

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-057)

The version of runfinch-finch installed on the remote host is prior to 1.7.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-057 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Prior to5.2.2 and 4.5.2, the function parse.ParseUnverified split...

AI-Based Crypto Tokens: the Illusion of Decentralized AI?

The convergence of blockchain and artificial intelligence AI has led to the emergence of AI-based tokens, which are cryptographic assets designed to power decentralized AI platforms and services. This paper provides a comprehensive review of leading AI-token projects, examining their technical...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-054)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-054 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line...

Important: runfinch-finch

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consist...