EUVD-2025-205598

Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent POST api/command/run. Version 1.15.1 fixes the issue...

pangolin 安全漏洞

pangolin is an agent software from the Pangolin open source. A security vulnerability exists in pangolin 1.6.2 and earlier versions, which stems from a problem with the 2FA component that could lead to elevation of privilege...

Tugtainer 命令注入漏洞

Tugtainer is an automated Docker container update application with a web UI by the individual developer Eugene Savin. A command injection vulnerability exists in Tugtainer versions prior to 1.15.1, which stems from the POST api/command/run interface of tugtainer-agent that can inject arbitrary...

Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks

Powerful autonomous systems, which reason, plan, and converse using and between numerous tools and agents, are made possible by Large Language Models LLMs, Vision-Language Models VLMs, and new agentic AI systems, like LangChain and GraphChain. Nevertheless, this agentic environment increases the...

PT-2025-53753

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.15.1 Description Tugtainer is a self-hosted application designed for automating updates of docker containers. A flaw exists where arbitrary arguments can be injected. This occurs through the POST api/command/run...

Security update for buildah

This update for buildah fixes the following issues: CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated message size bsc1254054 CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type in...

SUSE-SU-2025:4526-1 Security update for buildah

This update for buildah fixes the following issues: - CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated message size bsc1254054 - CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type...

blacksmith

BlacksmithAI OPEN-SOURCE AI-Powered Penetration Testing F...

Analyzing Code Injection Attacks on LLM-Based Multi-Agent Systems in Software Development

Agentic AI and Multi-Agent Systems are poised to dominate industry and society imminently. Powered by goal-driven autonomy, they represent a powerful form of generative AI, marking a transition from reactive content generation into proactive multitasking capabilities. As an exemplar, we propose a...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

GHSA-2MJ3-6GRC-PX38 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, elastic-agent, apm-server, cloudbeat, beats-fips...

CVE-2025-68383 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, elastic-agent, apm-server, cloudbeat, beats-fips...

CLSA-2025-1766567686 Fix CVE(s): CVE-2025-32728

SECURITY UPDATE: DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. - debian/patches/CVE-2025-32728.patch: fix logic error in DisableForwarding option - CVE-2025-32728...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47738 CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47738 CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CLSA-2025-1766502382 keylime: Fix of CVE-2025-13609

CVE-2025-13609: enforce TPM identity immutability for agent UUIDs in registrar, add shared memory for multiprocess synchronization...

CVE-2025-8305

An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files...

CVE-2025-8304

An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server...