6764 matches found
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking , a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. The targets...
Code Injection in pyload-ng
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31...
PYSEC-2026-541 Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
PT-2026-53569
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41...
GO-2026-5756 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome...
GO-2026-5755 Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph
Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph...
GO-2026-5640 Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API in github.com/daptin/daptin
Daptin: SQL injection via unvalidated goqu.L calls in aggregate API in github.com/daptin/daptin...
GO-2026-5674 OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao
OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao...
GO-2026-5557 Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend
Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend...
GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0
Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...
GO-2026-5588 Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker
Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker...
GO-2026-5623 Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0...
GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao
OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...
GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf
androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...
GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...
GO-2026-5252 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import volume omitted in github.com/lxc/incus...
GO-2026-5222 nhost has Session Persistence After Password Change in github.com/nhost/nhost
nhost has Session Persistence After Password Change in github.com/nhost/nhost...
GO-2026-5187 PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw
PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw...
GO-2026-5088 kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp...