2766 matches found
Automatic Red Teaming LLM-Based Agents with Model Context Protocol Tools
The remarkable capability of large language models LLMs has led to the wide application of LLM-based agents in various domains. To standardize interactions between LLM-based agents and their environments, model context protocol MCP tools have become the de facto standard and are now widely...
CVE-2025-7106
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some to validate permissions, which incorrectly grants access if only one of multiple required...
CVE-2025-7106
CVE-2025-7106 : In danny-avila/librechat, an authorization bypass is caused by the checkAccess function in api/server/middleware/roles/access.js using permissions.some() to validate required permissions. This logic can grant access if any one of multiple permissions is present, allowing users wit...
CVE-2025-7106 Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some to validate permissions, which incorrectly grants access if only one of multiple required...
CVE-2025-7106 Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some to validate permissions, which incorrectly grants access if only one of multiple required...
PT-2025-39160
Name of the Vulnerable Software and Affected Versions librechat versions prior to the fix Description An authorization bypass exists due to incorrect access control checks. The checkAccess function within api/server/middleware/roles/access.js utilizes permissions.some for permission validation,...
How to Gain Control of AI Agents and Non-Human Identities
We hear this a lot: "We've got hundreds of service accounts and AI agents running in the background. We didn't create most of them. We don't know who owns them. How are we supposed to secure them?" Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identitie...
BIT-JENKINS-2025-59474
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget...
CVE-2025-55110
Control-M/Agents use a kdb or PKCS12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password...
MAL-2025-47415 Malicious code in top-crawl-agents (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9696763f6821540dd1025eb17efe91e97175725aa5add6b347bfc09db48e33cc Any computer that has this package installed or running should be considered...
Malicious code in top-crawl-agents (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9696763f6821540dd1025eb17efe91e97175725aa5add6b347bfc09db48e33cc Any computer that has this package installed or running should be considered...
CVE-2025-55110
Control-M/Agents use a kdb or PKCS12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password...
CVE-2025-55110 BMC Control-M/Agent hardcoded default keystore password
Control-M/Agents use a kdb or PKCS12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password...
PT-2025-37940
Name of the Vulnerable Software and Affected Versions: Control-M/Agents affected versions not specified Description: Control-M/Agents utilize a kdb or PKCS12 keystore by default, employing a well-known and documented default password. An attacker possessing read access to the keystore can...
Realistic Environmental Injection Attacks on GUI Agents
GUI agents built on LVLMs are increasingly used to interact with websites. However, their exposure to open-world content makes them vulnerable to Environmental Injection Attacks EIAs that hijack agent behavior via webpage elements. Many recent studies assume the attacker to be a regular user who...
Securing AI Agents: Implementing Role-Based Access Control for Industrial Applications
The emergence of Large Language Models LLMs has significantly advanced solutions across various domains, from political science to software development. However, these models are constrained by their training data, which is static and limited to information available up to a specific date...
RHSA-2025:15622 Red Hat Security Advisory: fence-agents security update
Bulletin has no description...
RHSA-2025:15618 Red Hat Security Advisory: resource-agents security update
Bulletin has no description...