CVE-2026-0762

GPT Academic streamdaas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but...

CVE-2026-0762 GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability

GPT Academic streamdaas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but...

CVE-2026-0760

Foundational Software: Foundation Agents MetaGPT. The CVE-2026-0760 issue is in the deserialize_message function where unvalidated untrusted data can be deserialized, enabling Remote Code Execution with network access and no authentication. Documented impact states an attacker can execute code in...

GPT Academic Code Issues and Vulnerabilities

GPT Academic is an interface developed by binary-husky developers, designed to provide practical interactions for large language models like GPT/GLM. GPT Academic has code vulnerabilities; these vulnerabilities stem from the lack of validation for data provided by users at the upload endpoint,...

GPT Academic Code Issues and Vulnerabilities

GPT Academic is an interface developed by binary-husky developers, designed to provide practical interactions for large language models like GPT/GLM. There are code vulnerabilities in GPT Academic; these vulnerabilities stem from the runinsubprocesswrapperfunc function, which lacks validation of...

MiracleLinux 8 : gdisk-1.0.3-11.el8 (AXSA:2022-4240:03)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4240:03 advisory. gdisk: possible out-of-bounds-write in LoadPartitionTable of gpt.cc CVE-2020-0256 gdisk: possible out-of-bounds-write in ReadLogicalParts of...

CVE-2025-23348

NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretraingpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data...

(0Day) GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the runinsubprocesswrapperfunc function. The issue results from the lack of proper validati...

(0Day) GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the...

PT-2026-1994

Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is...

PT-2026-1992

Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists in the stream daas function that allows remote attackers to execute arbitrary code on affected systems. This is due to insufficient validation of user-supplied data, leadin...

Low Rank Comes with Low Security: Gradient Assembly Poisoning Attacks against Distributed LoRA-Based LLM Systems

Low-Rank Adaptation LoRA has become a popular solution for fine-tuning large language models LLMs in federated settings, dramatically reducing update costs by introducing trainable low-rank matrices. However, when integrated with frameworks like FedIT, LoRA introduces a critical vulnerability:...

WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts vulnerability

Authenticated Admin+ PHP Object Injection via wpaicgexportprompts vulnerability discovered by Tran Anh Duc in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...

PT-2025-52381

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers megatron gpt2 affected versions not specified Description A flaw exists in the parsing of checkpoints within Hugging Face Transformers megatron gpt2, stemming from insufficient validation of user-supplied data. This c...

Evaluating LLMs for One-Shot Patching of Real and Artificial Vulnerabilities

Automated vulnerability patching is crucial for software security, and recent advancements in Large Language Models LLMs present promising capabilities for automating this task. However, existing research has primarily assessed LLMs using publicly disclosed vulnerabilities, leaving their...

WordPress AI Engine for WordPress: ChatGPT, GPT Content Generator plugin <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Ryan Kozak in WordPress Plugin AI Engine for WordPress: ChatGPT, GPT Content Generator versions = 1.0.1...

injection-research

injection-research A study comparing injection vulnerabilities...

TencentOS Server 3: gdisk (TSSA-2022:0237)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0237 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EchoGram Flaw Bypasses Guardrails in Major LLMs

HiddenLayer reveals the EchoGram vulnerability, which bypasses safety guardrails on GPT-5.1 and other major LLMs, giving security teams just a 3-month head start...

GPT-5 at CTFs: Case Studies from Top-Tier Cybersecurity Events

OpenAI and DeepMind's AIs recently got gold at the IMO math olympiad and ICPC programming competition. We show frontier AI is similarly good at hacking by letting GPT-5 compete in elite CTF cybersecurity competitions. In one of this year's hardest events, it outperformed 93% of humans finishing...