21878 matches found
cve-2024-38077-madlicense_reproduction
CVE-2024-38077: Windows Remote Desktop Licensing Service Remote Code Execution "MadLicense" I. Vulnerability Overview CVE ID : CVE-2024-38077 Alias : MadLicense CVSS Score : 9.8 Critical Type : Heap-Based Buffer Overflow CWE-122 Discovered by : Ver, Lewis Lee, Zhiniang Peng Description : A...
PT-2026-121658
Name of the Vulnerable Software and Affected Versions Amazon Strands Agents SDK for Python versions prior to 1.43.0 Amazon Strands Agents SDK for TypeScript versions prior to 1.5.0 Description The A2A server component fails to properly isolate conversation state between callers. An authenticated...
cve-2021-45046
Although log4j RCE CVE-2021-44228 was patched in 2.15, a new vulnerability, CVE-2021-45046 causing DoS, has been discovered. Below are the test results. Test Environment log4j-2.15.0 api , core JRE-1.8.0 jdk1.8.0151 Eclipse IDE Maven Project 1. Log4j RCE CVE-2021-44228 syntax test - Not Vuln 2...
Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents
Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed...
The Psychology of an AI Hacker
Human hackers rely on composure, persistence, vigilance, and confidence under pressure. We investigate whether analogous emotion representations in AI models can improve cybersecurity AI performance. Using CT0, a 4B-parameter cybersecurity transformer released as alias3-micro, we extract 171...
MPIDetector: Detecting Multi-Modal Prompt Injection Via LLM-Based Reasoning
With the rapid integration of Multi-modal Large Language Models MLLMs into real-world applications, Prompt Injection PI has emerged as a critical security threat. Attackers can conceal malicious instructions within textual narratives or visual inputs to bypass safety alignment. Existing approache...
SUSE CVE-2026-98646
In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...
CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...
CVE-2026-96406
The USBX host is vulnerable to an out-of-bounds read (CWE-125) during the processing of a VideoStreaming interface . The host incorrectly uses the device-controlled wTotalLength field from the input header as a budget for walking format, frame, and frame-interval descriptors without validating it...
CVE-2022-2466---Request-Context-not-terminated-with-GraphQL
CVE-2022-2466 Request-Context-not-terminated-with-GraphQL How to run 1. run mvn:quarkus:dev 2. run the following http requests RUN THIS TWICE POST http://localhost:8080/graphql Content-Type: application/graphql Authorization: Bearer...
CLEANSTART-2026-YT71369 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
Linux Distros Unpatched Vulnerability : CVE-2026-98590
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits...
Linux Distros Unpatched Vulnerability : CVE-2026-98646
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still...
GO-2026-6774 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI...
UBUNTU-CVE-2026-98646
In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...
CVE-2026-98590
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...
UBUNTU-CVE-2026-98745
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...
UBUNTU-CVE-2026-98590
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...
CVE-2026-98745
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...
From TCP/IP to MCP: Security and Governance Lessons from Internet Protocols for Agentic AI
The past two years have seen considerable interest in protocols for managing how AI agents interact with human users, external tools, and each other. In many ways, these protocols, including the Model Context Protocol MCP and Agent2Agent A2A, mirror the suite of protocols that underlie the modern...