CVE-2026-90603

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90602

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

AI-Red-Teaming-Playground-Labs

Laboratorios de Práctica de AI Red Teaming Este repositorio contiene los retos para los laboratorios utilizados en el curso "AI Red Teaming in Practice". El curso se impartió originalmente en Black Hat USA 2024 por Dr. Amanda Minnich y Gary Lopez. Martin Pouliot se encargó de la infraestructura y...

PurpleLlama

🤗 Modelos en Hugging Face | Blog | Sitio web | Artículo de CyberSec Eval | Artículo de Llama Guard Purple Llama Purple Llama es un proyecto general que, con el tiempo, reunirá herramientas y evaluaciones para ayudar a la comunidad a desarrollar soluciones de forma responsable con modelos...

osint_toolkit

OSINT Toolkit 警告 OSINT Toolkit 尚未准备好投入生产。这只是一个早期原型，仍需进一步完善。 专为安全分析师打造的全栈 Web 应用程序 OSINT Toolkit 是一个可自托管、按需分析平台，专为安全专家设计。它将多种安全工具整合到单一、易用的环境中，以简化日常工作。针对单用户操作进行了优化，OSINT Toolkit 在 Docker 容器内本地运行，不用于长期数据存储或管理。相反，它专注于加速日常工作流，例如：新闻聚合与分析、IOC 和电子邮件调查，以及威胁检测规则的创建。为进一步提升效率，OSINT Toolkit 集成了生成式 AI...

PyRIT

Herramienta Python de Identificación de Riesgos para IA generativa PyRIT La herramienta Python de Identificación de Riesgos para IA generativa PyRIT es un marco de código abierto creado para capacitar a los profesionales de la seguridad y a los ingenieros a identificar riesgos de forma proactiva ...

offensive-ai-compilation

📁 Contenidos 📁 🚫 Abuso 🚫 🧠 Aprendizaje Automático Adversarial 🧠 ⚡ Ataques ⚡ 🔒 Extracción 🔒 ⚠️ Limitaciones ⚠️ 🛡️ Acciones defensivas 🛡️ 🔗 Enlaces útiles 🔗 ⬅️ Inversión o inferencia ⬅️ 🛡️ Acciones defensivas 🛡️ 🔗 Enlaces útiles 🔗 💉 Envenenamiento 💉 🔓 Puertas traseras 🔓 🛡️ Acciones defensivas 🛡️ 🔗...

Stevos-AI-Blocklist

Stevo 的 AI 拦截列表 一个适用于 uBlock Origin 和 AdGuard 的过滤列表，用于隐藏使用生成式 AI 的特定网站功能以及被标记为 AI 生成的内容。 适用于 PC/Linux（Firefox、Edge、Chrome、Brave）、macOS（Firefox、Edge、Chrome、Safari）、Android（Firefox）和 iOS/iPadOS（Safari、Brave）。 过滤内容示例 Google 的 AI 摘要 YouTube 的“提问”按钮、视频摘要、自动配音和“超分辨率”放大 GitHub、Bing、Microsoft 365 和 Azure...

PyRIT

生成式AI风险识别工具（PyRIT） 生成式AI风险识别工具（PyRIT）是一个开源框架，旨在帮助安全专业人员与工程师主动识别生成式AI系统中的风险。 !WARNING PyRIT 已搬迁！请访问 https://github.com/microsoft/PyRIT！...

PyRIT v1.1.0

Python Risk Identification Tool for generative AI PyRIT The Python Risk Identification Tool for generative AI PyRIT is an open source framework built to empower security professionals and engineers to proactively identify risks in generative AI systems. Check out our website for more information...

Why Generative AI Needs a New Kind of Security

This is Post 2 of a three-part series. Start withPost 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 3: OWASP LLM Top 10: What Comes Next – Agentic & MCP. There is a moment every CISO is having right now, often without warning. A developer shows a working internal demo of ...

EUVD-2026-39790

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...

GenAI Is Both Hunter and Hunted at Pwn2Own Berlin 2026

This year’s Pwn2Own competition in Berlin revealed just how much of the AI stack remains exposed -- and the gap between what these tools promise and what they can withstand point to the fragile security foundations underneath...

Context-Aware Spear Phishing: Generative AI-Enabled Attacks against Individuals Via Public Social Media Data

We demonstrate how publicly available social-media data and generative AI GenAI can be misused to automate and scale highly personalized, context-aware spear-phishing campaigns. With minimal attacker effort, a small amount of public activity per target is sufficient for GenAI models to extract...

What Security and Privacy Transparency Users Need from Consumer-Facing Generative AI

Users increasingly rely on consumer-facing generative AI GenAI for tasks ranging from everyday needs to sensitive use cases. Yet, it remains unclear whether and how existing security and privacy S&P communications in GenAI tools shape users' adoption decisions and subsequent experiences...

Understanding User Privacy Perceptions of GenAI Smartphones

GenAI smartphones, which natively embed generative AI at the system level, are transforming mobile interactions by automating a wide range of tasks and executing UI actions on behalf of users. Their superior capabilities rely on continuous access to sensitive and context-rich data, raising privac...

griptape 路径遍历漏洞

Griptape is an open-source generative AI application development framework created by Griptape. Version 0.19.4 of Griptape contains a path traversal vulnerability, which stems from incorrect handling of the parameter filename, potentially leading to path traversal attacks...

Observability for AI Systems: Strengthening visibility for proactive risk detection

Adoption of Generative AI GenAI and agentic AI has accelerated from experimentation into real enterprise deployments. What began with copilots and chat interfaces has quickly evolved into powerful business systems that autonomously interact with sensitive data, call external APIs, connect to...

This Week in Spring - March 17th, 2026

Hi, Spring fans! Welcome to another rip-roaring installment of This Week in Spring , which I'm posting ahead of my keynote at the amazing JavaOne 2026 event here in sunny San Francisco, California! I love Piotr's latest post on using local AI models with LM Studio and Spring AI Did you see the ne...

Security Considerations for Multi-Agent Systems

Multi-agent artificial intelligence systems or MAS are systems of autonomous agents that exercise delegated tool authority, share persistent memory, and coordinate via inter-agent communication. MAS introduces qualitatively distinct security vulnerabilities from those documented for singular AI...