nightcrawler

Nightcrawler An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity. ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀█ ▄▀█ █░█░█ █░░...

SecureML

SecureAIML 🔐 Enterprise-Ready AI Model Security built on OpenSSF Model Signing SecureAIML is the "Stripe for model security" - making enterprise-grade AI model protection accessible, user-friendly, and production-ready for every organization. Why SecureAIML? In the era of AI/ML, model security is...

gemma_crackme_tutorial

Using Google's Gemma 4 E4B local AI model to Reverse Engineer a simple Crackme I was playing around with the new Gemma E4B open weights local model which Google released, and to my surprise I was seeing a great deal of success in using it for local offline reverse engineering scenarios. I wanted ...

CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

CVE-2026-105038

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services are vulnerable to an authentication bypass (CWE-306) that allows unauthenticated remote attackers to access AI model administration functions . This vulnerability enables an attacker to modify AI model configurations and...

CVE-2026-105038: Missing Authentication for Critical Function

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

PT-2026-115225

Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO affected versions not specified Description The FastAPI AI inference and profiling services lack authentication for AI model administration functions. This allows an unauthenticated remote attacker to modify the AI...

Does AI Help Cyber Attackers or Defenders? Evidence from Nonpublic Vulnerabilities and Subsequent Attacks

The release decision for frontier AI systems increasingly relies on cyber capability benchmarks, yet public vulnerability benchmarks can expose agents to previously published advisories, exploits, and fixes, making it difficult to distinguish prior exposure from capability on unseen...

Booz Allen Cyber Weapon Index

The new Booz Allen Cyber Weapon Index CWI confirms that autonomous offensive cyber has arrived. A leading frontier AI model can now independently execute the full cyber kill chain against a real network—crossing a critical threshold from AI-assisted hacking to autonomous cyber operations. This is...

OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities

The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses...

org.springframework.ai:spring-ai-starter-model-chat-memory-repository-redis (2.0.0) potentially affected by CVE-2026-59319 via org.springframework.ai:spring-ai-model-chat-memory-repository-redis (2.0.0)

org.springframework.ai:spring-ai-model-chat-memory-repository-redis MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-model-chat-memory-repository-redis and may be impacted: -...

Incorrect Authorization

Overview org.springframework.ai:spring-ai-model is a Core model interfaces and classes for Spring AI Affected versions of this package are vulnerable to Incorrect Authorization through the DefaultToolCallingManager in...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1417 more potentially affected by CVE-2026-59318 via org.springframework.ai:spring-ai-model (>=1.0.0, <=2.0.0)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 and more Source cves: CVE-2026-59318 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-19233331...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the findByMetadata function. An attacker can access data from other conversations by injecting RediSearch syntax into user-controlled metadata fields. Remediation Upgrad...

org.springframework.ai:spring-ai-starter-model-chat-memory-repository-redis (2.0.0) potentially affected by CVE-2026-59319 via org.springframework.ai:spring-ai-model-chat-memory-repository-redis (2.0.0)

org.springframework.ai:spring-ai-model-chat-memory-repository-redis MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-model-chat-memory-repository-redis and may be impacted: -...

CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-28444

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker...

macOS Kernel Memory Corruption Exploit

A group used Anthropic's Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple's M5. News article...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +632 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +492 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-G...