ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

Astra Linux – vulnerability in golang-1.15

Versions prior to 1.15.13 and 1.16.x prior to 1.16.5 include functions for DNS lookups that do not validate responses from DNS servers. As a result, a return value may contain unsafe injections e.g., XSS, which do not conform to the RFC1035 format...

Surviving the Router: Optimizing Skill Injections for Retrieval and Execution

AI agents increasingly rely on modular third-party "skills" that are dynamically selected by skill routers to execute complex tasks. While recent studies highlight the threat of prompt injections embedded in these skills, existing evaluations often assume settings where the malicious skill is...

Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations

Large language models LLMs in production systems face prompt injections, trojans backdoors, and manipulation of automatic quality metrics. This thesis develops models, methods, and algorithms for evaluating and improving LLM robustness to adversarial input sequence variations. We propose Rstabf, ...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

SUSE CVE-2026-68480

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data...

CVE-2026-15733 WGDashboard Remote Code Execution vulnerability

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

CVE-2026-15733

WGDashboard versions 4.2.3 and earlier are vulnerable to a Remote Code Execution (RCE) flaw caused by multiple OS command injection points (CWE-78). This allows authenticated attackers to execute arbitrary commands with root privileges , potentially leading to a full system compromise. A Proof of...

CVE-2026-15733 WGDashboard Remote Code Execution vulnerability

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

ronin-exploits

ronin-exploits !CIhttps://github.com/ronin-rb/ronin-explo...

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-Based Web Agents

LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that...

CVE-2026-13946

An inappropriate implementation flaw was found in the ScriptInjections component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513274039...

Remote Code Execution (RCE)

MantisBT is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of eval when processing non-string configuration values in the Manage Configuration feature, which allows an administrator to inject malicious class definitions that execute arbitrary code through PHP's...

CVE-2026-15343

GitHub Enterprise Server (Dependabot updater container) contains a path traversal vulnerability that lets an attacker with code execution inside that container write to arbitrary repository paths, including .github/workflows/. The flaw arises because path validation did not properly enforce the e...

EUVD-2026-43644

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

Chromium: CVE-2026-13946 Inappropriate implementation in ScriptInjections

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-58213

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupti...

CVE-2026-13946

Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13946

Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...