871203 matches found
CVE-2026-118673 KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though...
Tracking AI adoption in North Korean threat actor tradecraft
In this article 1. Stages of AI adoption by North Korean threat actors 2. AI use across North Korean threat operations 1. AI-assisted targeting and reconnaissance 2. AI-assisted social engineering and identity deception 3. AI-assisted software and tooling development 4. AI-assisted operational...
CVE-2026-119118 Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-119118
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-119118
Crawl4AI versions prior to 0.9.5 are vulnerable to improper certificate validation because the underlying Chromium instance is launched with the --ignore-certificate-errors flag. This configuration allows network attackers to perform man-in-the-middle or DNS-poisoning attacks to intercept crawls,...
EUVD-2026-113185
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-119118 Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-119118 Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CGA-R7WM-8WX5-74VJ
Bulletin has no description...
CGA-HWPH-WJWW-WV3M
Bulletin has no description...
CGA-2984-43QW-QXXP
Bulletin has no description...
CGA-4J9M-QPF6-65J4
Bulletin has no description...
CGA-XPFJ-HP8M-J5WW
Bulletin has no description...
CGA-3JMJ-CMHX-PWQQ
Bulletin has no description...
CGA-X6VV-HRP9-CWRR
Bulletin has no description...
cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...
CGA-3F2H-2QW5-PMPR
Bulletin has no description...
CGA-68RH-Q68W-X929
Bulletin has no description...