Critical ‘Claw Chain’ Vulnerabilities Put Thousands of OpenClaw AI Servers at Risk

Critical Claw Chain vulnerabilities in OpenClaw expose thousands of AI servers to data theft, backdoors, and admin-level attacks globally this week...

PT-2026-41428

iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks agains...

Lack of vulnerability awareness in Microsoft Exchange Server

Microsoft has identified a vulnerability in Microsoft Exchange Server. This vulnerability involves a cross-site scripting XSS issue that arises due to improper handling of user input during the generation of web pages. An unauthorized attacker can inject malicious scripts and perform spoofing...

Microsoft Edge 跨站脚本漏洞

Microsoft Edge is a web browser included with Windows 10 and later versions from Microsoft. Microsoft Edge has a cross-site scripting vulnerability. Attackers use this vulnerability to carry out phishing attacks...

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) arises from insufficient validation of requests on the server side. This allows attackers to perform spear-phishing attacks.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

The vulnerability of the interactive browser-based environment Azure Cloud Shell, related to the lack of data cleansing at the management level, allows attackers to perform spoofing attacks.

The vulnerability of the Azure Cloud Shell, a browser-based interactive environment, is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability allows attackers to perform spear-phishing attacks remotely...

The vulnerability of the Microsoft PowerPoint presentation preparation and viewing software on Android operating systems, related to access control errors, allows attackers to perform spear-phishing attacks.

The vulnerability of the Microsoft PowerPoint presentation preparation and viewing software on Android operating systems is related to access control errors. Exploiting this vulnerability can allow attackers to carry out spoofing attacks...

The vulnerability of the software for working with Azure Machine Learning algorithms lies in the lack of measures taken to neutralize special elements in the output data, allowing attackers to perform spoofing attacks.

The vulnerability of the software for working with Azure Machine Learning algorithms is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to perform spearishing attacks...

DarkLLM: Learning Language-Driven Adversarial Attacks with Large Language Models

While vision and multimodal foundation models underpin critical tasks from perception to complex reasoning, they remain highly vulnerable to adversarial attacks. However, traditional adversarial attacks are typically limited to single, predefined objectives, tightly coupling each attack to a...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to the reliance on client-supplied IP address headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP. An attacker can circumvent per-IP rate limiting by supplying arbitrary values in these headers, causing...

GHSA-R29H-37FJ-X2W6 Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

Summary There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. Details It is possible permanently save any HTML/JavaScript code in the application, which can be then executed in the context of the application domain. This behaviour can be used to extract and stea...

Your iPhone Gets Stolen. Then the Hacking Begins

A bustling underground ecosystem is providing criminals with the tools to unlock iPhones—and wage phishing attacks against their contacts to access bank accounts and more...

WS-2020-0060

Versions of jsrsasign are vulnerable to Timing Attacks. The signHex function uses a timing-unsafe method for ECDSA key generation and signing. This leaks the length of the scalar, which attackers may use to brute-force the private key. Timing attacks can be used to increase the efficiency of...

WS-2020-0020

All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks...

anti-hacking

🛡️ anti-hacking: Comprehensive Defensive Security Knowledge Ba...

WS-2019-0059

All versions of express-basic-auth are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential...

WS-2014-0032

Affected versions of the json-jwt package before 0.6.1 are vulnerable to timing attacks...

WS-2013-0018

Python-rsa is vulnerable to side-channel attacks on decryption and signing...

Fleet 安全漏洞

Fleet is an open-source device management platform developed by Fleet Device Management. It supports various operating systems and devices, and helps IT and security teams with device management, vulnerability reporting, MDM operations, etc. Versions of Fleet prior to 4.80.1 contained security...

UGen: An Agentic Framework for Generating Microarchitectural Attack PoCs

Microarchitectural attacks continue to evolve, uncovering new exploitation vectors in modern processors. From a defensive perspective, assessing a system's susceptibility to such attacks remains challenging. Developing functional attack implementations is labor-intensive, requires deep...