cve-2026-54316-lab

CVE-2026-54316 — Claude Code WebFetch HuggingFace 数据外泄实验环境 一个自包含的、一次性使用的实验环境，复现了 GHSA-fg94-h982-f3mm / CVE-2026-54316：Claude Code 将 huggingface.co 作为 裸主机名 预先批准用于 WebFetch 工具，因此该域名上的 任意 路径 —— 包括攻击者控制的模型仓库 —— 都会在 无需权限提示 的情况下被获取。结合提示注入，这形成了一个用于窃取数据的带外通道，可通过 HuggingFace 的服务器端下载计数来观察。 | ---|--- 公告|...

cryptoquant-key-gen

CryptoQuant Breaker v1.6 — 2026 Desbloquea las funciones premium de CryptoQuant | Análisis avanzado y acceso a datos en tiempo real Descripción CryptoQuant Breaker es una potente utilidad de parcheo diseñada para eludir las restricciones del nivel de análisis avanzado de CryptoQuant y los límites...

CVE-2025-24271

CVE-2025-24271 Vulnerabilidad en AirPlay expone información sensible en dispositivos Apple [email protected] https://m10.com.mx/cve-2025-24271-vulnerabilidad-en-airplay-expone-informacion-sensible-en-dispositivos-apple/ Apple ha confirmado que los siguientes sistemas operativos son...

android-cve-2010-4804

Android数据窃取漏洞的概念验证。 CVE-2010-4804 原始公告...

CVE-2026-104402: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6...

PT-2026-104622

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17...

CVE-2026-97307: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17...

AutoDP-LLM: Automating Data Pre-Processing for Intrusion Detection Systems Using Large Language Models

The increasing complexity and scale of modern cyber-attacks demand intelligent and computationally efficient Intrusion Detection Systems IDS. However, designing effective data pre-processing pipelines traditionally involves substantial trial-and-error effort and repeated evaluation of alternative...

Can CaMeLs Talk? Securing Multi-Agent Systems against Indirect Prompt Injection Attacks

Indirect prompt injection attacks - malicious instructions embedded in content processed by large language models - remain a major obstacle to safely deploying tool-using agents. CaMeL Debenedetti et al., 2025 mitigates this threat for an individual agent by separating trusted control flow from...

PT-2026-104640

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6...

Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use

Jev turns natural-language questions into typed answers and probabilities with low latency and cost, enabling applications to route requests and select tools. While this interface allows Jev to integrate naturally into application workflows as a decision layer, the security and privacy implicatio...

PT-2026-104609

Name of the Vulnerable Software and Affected Versions Five Star Business Profile and Schema WordPress plugin versions prior to 2.4.0 Description Insufficient restriction of callbacks used to resolve schema field default values allows authenticated users with Author-level access and above to store...

CVE-2026-105218: Improper Certificate Validation

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

MAL-2026-17629 Malicious code in zencleaner (PyPI)

When a license key is activated or deactivated in the local UI, zencleaner/webhooklogger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Comprobador en Python 3 y hook de exploit configurable para CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Producto| REDCap Vanderbilt Afectados| ≥ 13.3.0 hasta el parche de la rama Corregido| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC 此存储库是Spring官方安全公告公开的 CVE-2026-41729 的最小复现PoC。 官方公告：https://spring.io/security/cve-2026-41729/ 官方标题：Spring Data REST SpEL Injection via Map Key in JSON Patch 严重级别：High CVSS v3.1：AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 公开日期：2026-06-...

CVE-2025-65482-XXE-

CVE-2025-65482 XXE XML External Entity Injection XXE in XDocReport Bug Definition XML External Entity Injection 漏洞概述 XML外部实体注入（XXE）是一种处理XML格式数据时的漏洞，用户插入引用外部文件或系统的XML数据。攻击者可以利用此已识别的XXE漏洞扫描其他系统的开放服务端口，请求机密文件，并访问已连接系统的功能（这些功能原本不可用）。由此，攻击者可以提取数据、与系统交互，并通过XML注入造成服务中断。 业务影响...

ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI

ShinyHunters hacker “Rey” was detained in Jordan and is reportedly cooperating with the FBI after the group claimed major FBI and corporate data breaches...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes 插件 = 5.0.12 AND time-based blind query SLEEP Payload: action=mylikesdislikesaction&post=1 AND SELECT 7318 FROM SELECTSLEEP5OIPg&state=dislike ---...

CVE-2022-26134

「💥」CVE-2022-26134 描述 受影响的 Confluence Server 和 Data Center 版本中存在一个 OGNL 注入漏洞，允许未经身份验证的攻击者在 Confluence Server 或 Data Center 实例上执行任意代码。受影响的版本范围：1.3.0 至 7.4.17 之前、7.13.0 至 7.13.7 之前、7.14.0 至 7.14.3 之前、7.15.0 至 7.15.2 之前、7.16.0 至 7.16.4 之前、7.17.0 至 7.17.4 之前、以及 7.18.0 至 7.18.1 之前。 演示 使用方法 pip install...