CVE-2026-0763: Deserialization of Untrusted Data

GPT Academic runinsubprocesswrapperfunc Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific...

GPT Academic Code Issues and Vulnerabilities

GPT Academic is an interface developed by binary-husky developers, designed to provide practical interactions for large language models like GPT/GLM. GPT Academic has code vulnerabilities; these vulnerabilities stem from the lack of validation for data provided by users at the upload endpoint,...

CVE-2026-0764: Deserialization of Untrusted Data

GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within...

MiracleLinux 8 : gdisk-1.0.3-11.el8 (AXSA:2022-4240:03)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4240:03 advisory. gdisk: possible out-of-bounds-write in LoadPartitionTable of gpt.cc CVE-2020-0256 gdisk: possible out-of-bounds-write in ReadLogicalParts of...

CVE-2025-23348

NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretraingpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data...

(0Day) GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the runinsubprocesswrapperfunc function. The issue results from the lack of proper validati...

(0Day) GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the...

PT-2026-1994

Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is...

PT-2026-1992

Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists in the stream daas function that allows remote attackers to execute arbitrary code on affected systems. This is due to insufficient validation of user-supplied data, leadin...

Low Rank Comes with Low Security: Gradient Assembly Poisoning Attacks against Distributed LoRA-Based LLM Systems

Low-Rank Adaptation LoRA has become a popular solution for fine-tuning large language models LLMs in federated settings, dramatically reducing update costs by introducing trainable low-rank matrices. However, when integrated with frameworks like FedIT, LoRA introduces a critical vulnerability:...

WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts vulnerability

Authenticated Admin+ PHP Object Injection via wpaicgexportprompts vulnerability discovered by Tran Anh Duc in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...

PT-2025-52381

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers megatron gpt2 affected versions not specified Description A flaw exists in the parsing of checkpoints within Hugging Face Transformers megatron gpt2, stemming from insufficient validation of user-supplied data. This c...

Evaluating LLMs for One-Shot Patching of Real and Artificial Vulnerabilities

Automated vulnerability patching is crucial for software security, and recent advancements in Large Language Models LLMs present promising capabilities for automating this task. However, existing research has primarily assessed LLMs using publicly disclosed vulnerabilities, leaving their...

WordPress AI Engine for WordPress: ChatGPT, GPT Content Generator plugin <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Ryan Kozak in WordPress Plugin AI Engine for WordPress: ChatGPT, GPT Content Generator versions = 1.0.1...

CVE-2025-13380: External Control of File Name or Path

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdaiupdatepost' AJAX endpoint and the use of filegetconten...

injection-research

injection-research A study comparing injection vulnerabilities...

TencentOS Server 3: gdisk (TSSA-2022:0237)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0237 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EchoGram Flaw Bypasses Guardrails in Major LLMs

HiddenLayer reveals the EchoGram vulnerability, which bypasses safety guardrails on GPT-5.1 and other major LLMs, giving security teams just a 3-month head start...

GPT-5 at CTFs: Case Studies from Top-Tier Cybersecurity Events

OpenAI and DeepMind's AIs recently got gold at the IMO math olympiad and ICPC programming competition. We show frontier AI is similarly good at hacking by letting GPT-5 compete in elite CTF cybersecurity competitions. In one of this year's hardest events, it outperformed 93% of humans finishing...

Trustworthiness Calibration Framework for Phishing Email Detection Using Large Language Models

Phishing emails continue to pose a persistent challenge to online communication, exploiting human trust and evading automated filters through realistic language and adaptive tactics. While large language models LLMs such as GPT-4 and LLaMA-3-8B achieve strong accuracy in text classification, thei...