CVE-2025-67743

CVE-2025-67743 affects Local Deep Research. The vulnerability lies in the download service (download_service.py) where HTTP requests are made with raw requests.get() without SSRF protection, bypassing safeguards in safe_requests.py/ssrf_validator.py. This can allow an attacker to access internal ...

CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...

CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...

CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...

NVIDIA Isaac Launchable 安全漏洞

NVIDIA Isaac Launchable is a one-click deployment GPU development environment designed to simplify the AI development process and accelerate experimentation and deployment. NVIDIA Isaac Launchable suffers from a security vulnerability that stems from improper design and can be exploited by remote...

PT-2025-52729

Name of the Vulnerable Software and Affected Versions Local Deep Research versions 1.3.0 through 1.3.8 Description The software is an AI-powered research assistant. A flaw exists in the download service download service.py where HTTP requests are made using raw requests.get calls, bypassing the...

This Week in Spring – December 23rd, 2025

Happy holidays, everyone! The year may be winding down, but the Spring ecosystem continues unabated. We’re now a few weeks past the generational Spring Boot 4.0 release in November, and there have been tons of releases and patches since then. There’s also equal excitement reflected in posts from...

Malicious code in ivx-cloud-client-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1fbfc03c64d280029c66ce70086ae89a6300a262c85cf73a4f3a55357ee56d The package ivx-cloud-client-v1 was found to contain malicious code...

MAL-2025-192695 Malicious code in ivx-cloud-client-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1fbfc03c64d280029c66ce70086ae89a6300a262c85cf73a4f3a55357ee56d The package ivx-cloud-client-v1 was found to contain malicious code...

EUVD-2025-204766

Malicious code in ivx-cloud-client-v1 npm...

CVE-2025-68644

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances...

Bringing Oracle Cloud Identity to Wiz

Unified visibility into OCI identities, permissions, and policies — mapped into Wiz’s Security Graph...

How an LMS Cloud Model Supports Scalable Learning

There's a new era for training and development programs, making the LMS Learning Management System cloud model the…...

NIST and CISA Release Draft Interagency Report on Protecting Tokens and Assertions from Tampering Theft and Misuse for Public Comment

The Cybersecurity and Infrastructure Security Agency CISA and National Institute of Standards and Technology NIST have released an initial draft of Interagency Report IR 8597 Protecting Tokens and Assertions from Forgery, Theft, and Misuse for public comment through January 30, 2026. This report ...

CVE-2025-15015

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

CVE-2025-15016

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user...

CVE-2025-15016

The CVE-2025-15016 entry relates to Ragic’s Enterprise Cloud Database, which is vulnerable due to a hard-coded cryptographic key that can be exploited by unauthenticated remote attackers to generate authentication data and log in as any user. Affected component: Ragic Enterprise Cloud Database (c...

EUVD-2025-204688

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user...

CVE-2025-15016 Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user...

CVE-2025-15015 Ragic｜Enterprise Cloud Database - Arbitrary File Read

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...