47 matches found
power-pwn
メンテナンス: AI エージェントをあらゆる場所でセキュアに。 概要 Power Pwn は、Microsoft 365 Power Platform および AI サービス向けの攻撃・防御両用セキュリティツールセットです。 主な機能（一部）: 💾 PowerDump : テナント全体のスキャンとデータ収集を包括的に実行 🚪 BackDoor : Power Platform 環境への永続的なアクセスを実現するバックドアフローを展開 🦠 NoCodeMalware : コードを書かずに悪意のある Power Platform アーティファクトを作成・展開 🎣 PowerPhishing ...
CVE-2026-83593: Improper Neutralization of Input During Web Page Generation
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible f...
WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability
Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, an...
CVE-2026-15106: Missing Authorization
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15610: Missing Authorization
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-13731: Improper Neutralization of Input During Web Page Generation
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible f...
Reconstructing AI activity in investigations
AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
Secrets sprawl isn't slowing down: in 2025, it accelerated faster than most security teams anticipated.GitGuardian's State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year an...
Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries
The threat actor behind the recently disclosed artificial intelligence AI-assisted campaign targeting Fortinet FortiGate appliances leveraged an open-source, AI-native security testing platform called CyberStrikeAI to execute the attacks. The new findings come from Team Cymru, which detected its...
Third-Party Service Secret Disclosure
Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data. Developers...
EUVD-2022-34112
Malicious code in bioql PyPI...
EUVD-2022-34117
Malicious code in bioql PyPI...
EUVD-2022-27408
Malicious code in bioql PyPI...
EUVD-2022-34110
Malicious code in bioql PyPI...
PT-2025-31924
Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server versions prior to 25.07 Description NVIDIA Triton Inference Server contains a flaw where an attacker can trigger a stack overflow through crafted HTTP requests. Successful exploitation could lead to remote code...
PT-2025-31923
Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server versions affected versions not specified Description NVIDIA Triton Inference Server for Windows and Linux has an issue where a specially crafted input can cause a stack buffer overflow. Successful exploitation ma...
CVE-2022-29791
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability will affect AI services...