12734 matches found
Under the Hood of SKILL.Md: Semantic Supply-Chain Attacks on AI Agent Skill Registry
Autonomous AI agents increasingly extend their capabilities through Agent Skills: modular filesystem packages whose SKILL.md files describe when and how agents should use them. While this design enables scalable, on-demand capability expansion, it also introduces a semantic supply-chain risk in...
PT-2026-39580
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The check user account lock states feature within the email OTP flow fails to validate user input. This allows an attacker to infer whether specific user account...
Why AI Agents Make API Security a CISO Priority
AI agents are not a future concern. They are already changing how enterprise systems are accessed, automated, and abused. And the security implication is clear: the more autonomous systems rely on APIs, the more important it becomes to know exactly which APIs exist, how they are being used, and...
CVE-2026-8223
A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcfsesssbidiscoverandsend of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made publi...
Position: AI Security Policy Should Target Systems, Not Models
We present swarm-attack, an open-source adversarial testing framework in which multiple lightweight LLM agents coordinate through shared memory, parallel exploration, and evolutionary optimization. Together, our results demonstrate that both safety bypass of frontier models and software...
CVE-2026-8195
creationtimestamp| type| source ---|---|--- 2026-05-09 22:00:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhalbqgdr2e...
CVE-2026-42576
CVE-2026-42576 affects chainguard/apko. Before v1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without key-type checks. If a repository JWKS endpoint returns a non-RSA key (e.g., EC), an unchecked type assertion panics, crashing apko ...
CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...
CVE-2026-42160
creationtimestamp| type| source ---|---|--- 2026-05-09 09:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116543798035791646 2026-05-09 09:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlfuzisord2y...
CVE-2026-8122
A vulnerability was found in Open5GS up to 2.7.7. This affects the function ogssbidiscoveryoptionaddservicenames in the library /lib/sbi/message.c of the component NSSF. The manipulation results in denial of service. The attack may be performed from remote. The exploit has been made public and...
NPM: Velocity.js has a Prototype Pollution vulnerability through #set path assignment
NPM: Velocity.js has a Prototype Pollution vulnerability through set path assignment discovered by ? in WordPress Npm velocityjs versions = 2.1.5...
NPM: fast-uri vulnerable to host confusion via percent-encoded authority delimiters
NPM: fast-uri vulnerable to host confusion via percent-encoded authority delimiters vulnerability discovered by ? in WordPress Npm fast-uri versions = 3.1.1...
EUVD-2026-28801
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning...
GHSA-H9HM-M2XJ-4RQ9 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all...
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all...
NPM: fast-xml-builder Comment Value regex can be bypassed
NPM: fast-xml-builder Comment Value regex can be bypassed vulnerability discovered by ? in WordPress Npm fast-xml-builder versions 1.1.5...
CVE-2026-44499
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent...
CVE-2026-44499 ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent...
CVE-2026-44499 ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent...