ghostsplice

GhostSplice: фрагментация доверия между каналами PoC-атака PoC-код для GhostSplice — атаки от ASSET Research Group. Полное описание: «ИИ отказался красть секреты. Поэтому мы дали ему форму». Суть простыми словами ИИ-ассистенты для программирования, такие как Cursor, VS Code с GitHub Copilot, Code...

otto-support

Otto Support MCP-сервер службы поддержки для AI-ассистентов написания кода. Один Go-бинарный файл, многоуровневая аутентификация, 19 инструментов на 4 уровнях ролей. Создан на основе mcp-go. Быстрый старт Вариант A: Docker-контейнер рекомендуется Запустите всё в изолированном контейнере. Claude...

awesome-dfir-skills

🔥 awesome-dfir-skills 커뮤니티 중심의 DFIR / 사고 대응 스킬 모음: 재사용 가능한 프롬프트, 워크플로우, 헬퍼 파일로 실무자가 더 빠르게 움직이고 일관성을 유지하며, 어쩌면—정말 어쩌면—잠을 좀 잘 수 있도록 도와줍니다. 🚀 빠른 시작 1. skills/README.md에서 스킬을 선택하세요 2. AI 어시스턴트Claude, Codex 등에 복사/붙여넣기 하세요 3. 프롬프트가 나오면 아티팩트를 제공하세요 4. 마법이 일어나는 것을 지켜보세요 ✨ 프로 팁: timewindow 같은 플레이스홀더는 그대로...

POC_CVE-2024-10829

POCCVE-2024-36420 Laboratoire de reproduction locale et brouillon de template nuclei pour CVE-2024-36420 affectant Flowise. Summary CVE-2024-36420 est une lecture arbitraire de fichier dans Flowise causée par l'utilisation non assainie du paramètre de corps fileName dans : POST...

POC_CVE-2024-36420

POCCVE-2024-36420 Laboratoire de reproduction local et brouillon de template nuclei pour CVE-2024-36420 affectant Flowise. Résumé CVE-2024-36420 est une lecture arbitraire de fichiers dans Flowise causée par l'utilisation non nettoyée du paramètre body fileName dans : POST...

PerceptFence: Content-Mediation Architecture and Deterministic Coverage for Screen-Share AI Assistants

Live screen-share AI assistants observe raw screen and speech streams, but users have little runtime control over what an assistant may observe, retain, or disclose. Prompt-level privacy settings are insufficient because sensitive content enters through the capture stream. We present PerceptFence...

One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

EUVD-2026-55702

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 expose a missing authorization vulnerability in POST /api/v1/openai-assistants-file/download. An unauthenticated attacker can bypass the global authentication whitelist to bypass session and API key verification and retrieve private files by supplying valid ch...

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

CVE-2026-71962: Missing Authorization

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

EUVD-2026-54171

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...

CVE-2026-67622: Authorization Bypass Through User-Controlled Key

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...