44 matches found
PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence
Cybersecurity researchers have discovered what they say is the first Android malware that abuses Gemini, Google's generative artificial intelligence AI chatbot, as part of its execution flow and achieves persistence. The malware has been codenamed PromptSpy by ESET. The malware is equipped to...
AI chat app leak exposes 300 million messages tied to 25 million users
An independent security researcher uncovered a major data breach affecting Chat & Ask AI, one of the most popular AI chat apps on Google Play and Apple App Store, with more than 50 million users. The researcher claims to have accessed 300 million messages from over 25 million users due to an...
Google Gemini Enterprise 安全漏洞
Google Gemini Enterprise is a generative AI platform developed by Google, Inc. of the United States. There is a security vulnerability in Google Gemini Enterprise, which stems from the use of predictable Google Cloud Storage bucket names. This vulnerability may allow attackers to preemptively tak...
Google Gemini MCP Tool operating system command injection vulnerability
Google Gemini MCP Tool is a tool component developed by Google Inc., based on large model context protocols. Google Gemini MCP Tool has a vulnerability related to operating system command injection. This vulnerability stems from the execAsync method, which executes system calls without verifying...
Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites
Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism. The vulnerability, Miggo Security's Head of Research, Liad...
Google Gemini AI Tricked Into Leaking Calendar Data via Meeting Invites
Cybersecurity researchers at Miggo Security found a flaw in Google Gemini that uses calendar invites to steal private data. Learn how this silent attack bypasses security...
Kibana 8.x < 8.19.10 / 9.1.x < 9.1.10 / 9.2.x < 9.2.4 (ESA_2026_05)
The version of Kibana installed on the remote host is prior to 8.19.10, 9.1.10, or 9.2.4. It is, therefore, affected by a vulnerability as referenced in the ESA202605 advisory. - An external control of file name or path combined with a server-side request forgery SSRF vulnerability exists in the...
External Control of File Name or Path
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to External Control of File Name or Path via the processing of JSON credentials in the Google Gemini connector configuration. An...
CVE-2026-0532
CVE-2026-0532 affects Kibana’s Google Gemini Connector. External control of a file name or path (CWE-73) combined with SSRF (CWE-918) enables an authenticated attacker with privileges to create/modify connectors to trigger arbitrary file reads and arbitrary network requests through a crafted cred...
CVE-2026-0532
External Control of File Name or Path CWE-73 combined with Server-Side Request Forgery CWE-918 can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticate...
Elastic Kibana 安全漏洞
Elastic Kibana is an available data visualization dashboard software from Elastic. A security vulnerability exists in Elastic Kibana that stems from a failure to adequately validate user-supplied credentials JSON loads when processing configurations for the Google Gemini connector, which could le...
PT-2026-2849
Name of the Vulnerable Software and Affected Versions Kibana versions prior to 8.19.10 Kibana versions prior to 9.1.10 Kibana versions prior to 9.2.4 Description An issue exists in Kibana where External Control of File Name or Path CWE-73 combined with Server-Side Request Forgery CWE-918 can allo...
Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-05)
External Control of File Name or Path and Server-Side Request Forgery SSRF in Kibana Google Gemini Connector ESA-2026-05 External Control of File Name or Path CWE-73 combined with Server-Side Request Forgery CWE-918 can allow an attacker to cause arbitrary file disclosure through a specially...
HashJack Attack Uses URL ‘#’ to Control AI Browser Behavior
Cybersecurity firm Cato Networks reveals HashJack, a new AI browser vulnerability using the '' symbol to hide malicious commands. Microsoft and Perplexity fixed the flaw, but Google's Gemini remains at risk...
Google Gemini iOS 安全漏洞
Google Gemini iOS is an AI-assisted tools app from Google, Inc. in the United States. Google Gemini iOS suffers from a security vulnerability that originates from the generation of public links containing the full conversation history when sharing conversation snippets, which could lead to...
Google Gemini CLI Installed (Windows)
Binary data googlegeminicliwininstalled.nbin...
Google Gemini CLI Installed (Linux/UNIX)
Binary data googlegeminiclinixinstalled.nbin...
Google Gemini CLI Installed (macOS)
Binary data googlegeminiclimacosinstalled.nbin...
No thanks: Google lets its Gemini AI access your apps, including messages [updated]
If you're an Android user, you'll need to take action if you don’t want Google's Gemini AI to have access to your apps. That's because, regardless of your previous settings, Google now allows Gemini to interact with third-party apps. Through Gemini extensions, it already had the ability to...
