39308 matches found
SUSE CVE-2026-64713
This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...
Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems
Retrieval-Augmented Generation RAG grounds Large Language Model LLM outputs in external knowledge, but RAG systems usually trust whatever they retrieve, creating a Security-Reliability Gap: high semantic relevance does not guarantee factual truth. Adversaries exploit this through knowledge...
Enhancing User Resilience against AI-Augmented Phishing: A Two-Stage Framework for Detection and Personalized Training
The rapid development of artificial intelligence, including agents and deepfake techniques, has accelerated phishing attacks and lowered the threshold for attackers. Modern phishing attacks now blend multiple tactics, including social engineering, URL spoofing, and AI deepfakes enabling adversari...
Workplace Surveillance and Insider Threat Risk Management: Legal Limits and Privacy Harms
Workplace surveillance is used by organizations to protect corporate assets and monitor employee productivity. This research presents two central arguments on workplace surveillance: although surveillance serves legitimate organizational purposes, over-surveillance can violate legal requirements...
CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-64713
A flaw was found in WebKitGTK. Visiting a website allows malicious web content to know if a user has visited a given link due to improper checks. Mitigation Do not visit untrusted websites or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require...
CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
CVE-2026-73256 Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...
CVE-2026-53424
CVE-2026-53424 is an authentication bypass by capture-replay in dropbox/samly , a SAML service provider library for Elixir, affecting versions 0.3.0 and later . The root cause is that Samly.Helper.decode_idp_auth_resp/3 calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no...
EEF-CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
Summary Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate...
CVE-2025-62307
HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...
EUVD-2025-210750
HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...
CVE-2025-62307 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...
CVE-2025-62307
HCL IntelliOps Event Management (IEM) suffers from insufficient logging, weakening accountability, obscuring attack detection, and enabling privilege probing. CVSS 3.1 scores it MEDIUM (5.4) with network attack vector, low privileges required, and low confidentiality/integrity impact. No exploita...
Antiphishing v32278722593
DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...
Specter-FlipperZero v2.7
Specter 👻 Sweep for the readers you can't see. -26E8CA?style=for-the-badge Specter turns your Flipper Zero into a pocket counter-surveillance bug-sweep for active 13.56 MHz NFC readers. It passively listens for the RF field that a powered-on reader is constantly emitting — a hidden card skimmer...
akto v2.20.1
Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...
sshroute v0.2.11
sshroute CI| Code| OpenSpec| Security ---|---|---|--- | | | Net...
ransomwhere v1.3.1
Ransomwhere A Proof of Concept ransomware sample that encrypts your files to test out your ransomware detection & prevention strategies. If no arguments are provided, ransomwherewill automatically execute the encrypt mode without deleting the original files. I am not responsible for any damage...