7981 matches found
Turning threat intelligence into decisive action with Defender Experts
In this article 1. Upstream: See the campaign before it reaches you 1. In your environment: Follow the threat everywhere it moves 2. See it live at Black Hat USA Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities,...
CVE-2026-57833
The CVE affects the Joomla extension 4Analytics for weeblr.com, with an unauthenticated stored XSS vulnerability in the AI analysis feature present in versions prior to 5.0.2. The underlying issue is a stored XSS in the AI analysis workflow, leading to high impact on confidentiality, integrity, a...
CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2
Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...
MAL-2026-10629 Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
EUVD-2026-43780
Improper neutralization of input during web page generation 'cross-site scripting' in Power BI allows an authorized attacker to perform spoofing over a network...
CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability
...
How Pentera Turns AI Security Workflows into Validation Engines
AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and help teams move faster. But most still rely on fragmented risk signals: scanner output, severity scores, threat intelligence, configuration findings, an...
EUVD-2026-43547
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...
This Week in Spring - July 14th, 2026
This Week in Spring - July 14th, 2026 In two short months, on this date in September, Java 27 will be here! Who's excited? I'm excited! I'm in delightful Denver, CO, for the amazing UberConf. I just delivered a workshop that was scheduled from 09:00 to 17:00, but it went into overtime, and we jus...
CVE-2026-62328
Summary: CVE-2026-62328 affects 9Router up to version 0.4.41 and describes an unauthenticated information-disclosure vulnerability exposed via unprotected API endpoints. Attackers can remotely query the request-logs and request-details routes (which lack authentication middleware) to enumerate pa...
CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...
CVE-2026-6875
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying...
CVE-2026-6875 Sandbox Escape in ServiceNow AI Platform
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying...
K000162232: Spring AI vulnerability CVE-2026-41713
Security Advisory Description A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversati...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
CERTFR-2026-CTI-004
creationtimestamp| type| source ---|---|--- 2026-07-13 09:25:58+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116911948082559856...
PT-2026-57852
Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A critical pre-authentication sandbox-escape flaw exists in the ServiceNow AI Platform. This issue allows an unauthenticated attacker to bypass the platform's sandbox environme...
PT-2026-59163
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to but not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictabl...
The vulnerability of the filter_allowed_access_grants() function in the Open WebUI artificial intelligence-based web interface, which allows a violator to increase their privileges
The vulnerability of the filterallowedaccessgrants function in the Open WebUI AI-based web interface is related to the lack of authorization during the processing of the final endpoint /api/v1/channels/id/members. Exploiting this vulnerability could allow a malicious actor to increase their...
