Microsoft Dynamics 365 信息泄露漏洞

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. It is used for financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365. An attacker...

9 Key Areas to Monitor for Potential Security Threats

The old "castle-and-moat" approach to security is a thing of the past. Your organization's perimeter is no longer a single, defensible line; it's a distributed and porous collection of remote employees, cloud services, and third-party vendors. Every connection is a potential entry point, and your...

Empower and Accelerate Your SOC with the Blue Agent

Meet the Blue Agent: AI-powered threat triage built on the Wiz platform. Investigate every threat with speed and transparency...

Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks

How secure are top private AI companies? Find out from our scans and disclosures...

AI Pulse: AI Bots Are Targeting Commerce, Publishers, and High Tech

...

This Week in Spring - November 10th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am preparing for a flight to North Carolina first in flight!. This week's going to be busy, but next week even busier still! I'll be at AI By The Bay in San Francisco, AI Native Dev Con in NYC, and QCon SF i...

Exploit for CVE-2025-11749

CVE-2025-11749 AI Engine = 3.1.3 - Unauthenticated Sensiti...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

Strategic Benefits of Vulnerability Prioritization

Think of your security team as the staff in a hospital emergency room. They can't treat every patient at once, so they perform triage, focusing on the most critical cases first to save lives. Vulnerability prioritization is security triage. Your organization has a seemingly endless list of...

Faking Receipts with AI

Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers--I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required...

Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

Cybersecurity researchers have flagged a malicious Visual Studio Code VS Code extension with basic ransomware capabilities that appears to be created with the help of artificial intelligence – in other words, vibe-coded. Secure Annex researcher John Tuckner, who flagged the extension "susvsex,"...

GHSA-RWVC-J5JR-MGVH Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-48985

The CVE-2025-48985 vulnerability affects Vercel’s AI SDK, with fixes in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. The issue is an input-validation bypass that could allow bypassing filetype whitelists during file uploads. Connected sources confirm remediation via upgrading the AI SDK. Impact...

CVE-2025-63639

The CVE-2025-63639 entry describes an XSS vulnerability in Sourcecodester FAQ Bot with AI Assistant v1.0, specifically in the chat feature where user input is not properly sanitized. Affected component: chat/messages handling in the FAQ Bot. Root cause: improper handling of user-supplied input le...

CVE-2025-63639

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting XSS due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing th...

Large Language Models for Explainable Threat Intelligence

As cyber threats continue to grow in complexity, traditional security mechanisms struggle to keep up. Large language models LLMs offer significant potential in cybersecurity due to their advanced capabilities in text processing and generation. This paper explores the use of LLMs with...

Cisco Unified Intelligence Center API Information Disclosure (cisco-sa-cc-mult-vuln-gK4TFXSn)

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this...

CVE-2025-20377

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 27, 2025 to November 2, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Operation: Maximum Impact Challenge ! Now through November 10, 2025, earn 2X bounty rewards forall in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 pe...