60 matches found
power-pwn
Maintained by: Secure AI Agents Everywhere. Overview Power Pwn is an offensive and defensive security toolset for Microsoft 365 Power Platform and AI services. Key Features, among others: 💾 PowerDump : Comprehensive tenant scanning and data collection 🚪 BackDoor : Deploy backdoor flows for...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF004 and 26.0.1-IF001 for October 2026
Summary IBM Content Cortex CCx 26.0.0-IF004 and 26.0.1-IF001 addresse CVEs across components including AI Services & tools, FDM, GraphQL, CSS and CPE Vulnerability Details CVEID:CVE-2026-59950 DESCRIPTION: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context...
CVE-2026-87936
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...
ai-services (>=0.5.0rc15, <=0.5.0rc16), sanic-beskar (>=2.2.9, <=2.2.10) potentially affected by CVE-2026-85078 via sanic (23.3.0)
sanic PYPI version 23.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ai-services =0.5.0rc15, =2.2.9, =2.2.10 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...
ai-services (>=0.5.0rc15, <=0.5.0rc16), sanic-beskar (>=2.2.9, <=2.2.10) potentially affected by CVE-2026-85078 via sanic (23.3.0)
sanic PYPI version 23.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ai-services =0.5.0rc15, =2.2.9, =2.2.10 Source cves: CVE-2026-85078 Source advisory: OSV:GHSA-WMJ6-G64G-J7Q5...
CVE-2026-83593: Improper Neutralization of Input During Web Page Generation
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-16773: Exposure of Sensitive Information to an Unauthorized Actor
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...
WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability
Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, an...
CVE-2026-15610: Missing Authorization
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15106: Missing Authorization
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-13731: Improper Neutralization of Input During Web Page Generation
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible f...
Reconstructing AI activity in investigations
AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
Secrets sprawl isn't slowing down: in 2025, it accelerated faster than most security teams anticipated.GitGuardian's State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year an...
Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries
The threat actor behind the recently disclosed artificial intelligence AI-assisted campaign targeting Fortinet FortiGate appliances leveraged an open-source, AI-native security testing platform called CyberStrikeAI to execute the attacks. The new findings come from Team Cymru, which detected its...
Third-Party Service Secret Disclosure
Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data. Developers...
EUVD-2022-34110
Malicious code in bioql PyPI...
EUVD-2022-34112
Malicious code in bioql PyPI...