JPRO: Automated Multimodal Jailbreaking Via Multi-Agent Collaboration Framework

The widespread application of large VLMs makes ensuring their secure deployment critical. While recent studies have demonstrated jailbreak attacks on VLMs, existing approaches are limited: they require either white-box access, restricting practicality, or rely on manually crafted patterns, leadin...

CVE-2025-43079: Untrusted Search Path

The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...

PT-2025-46151

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2025.3.104432 Description A race condition existed that allowed bypassing the Agent-user limit. Recommendations Update to version 2025.3.104432 or later...

CVE-2025-48878: Missing Authorization

Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user e.g. with Service desk agent profile to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue...

CVE-2025-64682: Concurrent Execution using Shared Resource with Improper Synchronization

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit...

JetBrains Hub 竞争条件问题漏洞

JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. A Competitive Conditions Issue vulnerability exists in versions of JetBrains Hub prior to 2025.3.104432, which stems from the presence of a...

Motex LanScope Endpoint Manager Detection Agent (DA) Installed (Windows)

Binary data motexlanscopeendpointmanagerdetectionagentinstalled.nbin...

google-osconfig-agent-20251028.00-1.1 on GA media (moderate)

google-osconfig-agent-20251028.00-1.1 on GA media Announcement ID: openSUSE-SU-2025:15709-1 Rating: moderate Cross-References: CVE-2025-47911 CVE-2025-58190 CVSS scores: CVE-2025-47911 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-47911 SUSE : 6.9...

OPENSUSE-SU-2025:15709-1 google-osconfig-agent-20251028.00-1.1 on GA media

These are all security issues fixed in the google-osconfig-agent-20251028.00-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-55108

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...

CVE-2025-55108 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...

CVE-2025-55108

The CVE-2025-55108 entry concerns BMC Control-M/Agent and describes unauthenticated remote code execution, plus arbitrary file read/write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (default configuration). Affected component: Control-M/Agent; root cause cen...

CVE-2025-55108 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...

Cross-site Scripting (XSS)

s-cart/core and gp247/core are vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the User-Agent header in the Admin Log Viewer, which allows an attacker to inject malicious scripts that execute in an administrator’s browser when viewing the security log...

CVE-2025-55108: Missing Authentication for Critical Function

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...

PT-2025-47791

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.9.0 through 4.12.9 Description Wazuh, a security detection, visibility, and compliance open source project, has an issue where the API – Agent Configuration, in specific setups, permits authenticated users with read-only API...

BMC Control-M/Agent 安全漏洞

BMC Control-M/Agent is a workload automation system from BMC USA. A security vulnerability exists in BMC Control-M/Agent that stems from not enabling mutual SSL/TLS authentication, which could lead to unauthenticated remote code execution, arbitrary file reads and writes, and similar unauthorized...

PT-2025-45096

Name of the Vulnerable Software and Affected Versions BMC Control-M/Agent affected versions not specified Description The Control-M/Agent is susceptible to unauthenticated remote code execution, arbitrary file read and write, and other unauthorized actions when mutual SSL/TLS authentication is no...

CVE-2025-8558

Insider Threat Management ITM Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents t...

DSPy does not properly restrict file reads

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class...