1655 matches found
MCP Server SSE DNS Rebinding
ModelContextProtocol MCP servers using SSE Server-Sent Events transport mode are prone to DNS rebinding attacks when they do not enforce strict verification of both the 'Origin' and 'Host' headers. This vulnerability allows an attacker to bypass same-origin policies, potentially leading to...
AgentSmith Flaw in LangSmith’s Prompt Hub Exposed User API Keys, Data
A CVSS 8.8 AgentSmith flaw in LangSmith's Prompt Hub exposed AI agents to data theft and LLM manipulation. Learn how malicious AI agents could steal API keys and hijack LLM responses. Fix deployed...
CVE-2025-49149
Dify, an open-source LLM app platform, has a vulnerability in version 1.2.0 caused by insufficient filtering of user input in web applications, allowing injection of malicious script and potentially leading to cross-site scripting (XSS) when users browse affected pages. The CVE entries consistent...
AgentVigil: Generic Black-Box Red-Teaming for Indirect Prompt Injection against LLM Agents
The strong planning and reasoning capabilities of Large Language Models LLMs have fostered the development of agent-based systems capable of leveraging external tools and interacting with increasingly complex environments. However, these powerful features also introduce a critical security risk:...
Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence AI vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 M365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the...
Enabling Secure AI Inference: Trend Cybertron Leverages NVIDIA Universal LLM NIM Microservices
Learn how Trend's Cybertron has been harnessing the power of NVIDIA Universal LLM NIM Microservices...
Llms.txt File Detected
This is an informational plugin to inform the user that the scanner has detected a publicly accessible 'llms.txt' file on the target application. The 'llms.txt' file is a proposal designed to provide LLM-friendly content written in markdown for LLMs usage. This detection is included in the AI and...
JavelinGuard: Low-Cost Transformer Architectures for LLM Security
We present JavelinGuard, a suite of low-cost, high-performance model architectures designed for detecting malicious intent in Large Language Model LLM interactions, optimized specifically for production deployment. Recent advances in transformer architectures, including compact BERTDevlin et al...
Rules Files for Safer Vibe Coding
Helping LLMs generate safer and more secure code through open-sourced rules files...
Client-Side Zero-Shot LLM Inference for Comprehensive In-Browser URL Analysis
Malicious websites and phishing URLs pose an ever-increasing cybersecurity risk, with phishing attacks growing by 40% in a single year. Traditional detection approaches rely on machine learning classifiers or rule-based scanners operating in the cloud, but these face significant challenges in...
Typebot Chatbot Detected
This is an informational plugin to inform the user that the scanner has detected a publicly accessible Typebot chatbot on the target application. Typebot is an open-source chatbot builder. This detection is included in the AI and LLM category. No source data...
Botpress Chatbot Detected
This is an informational plugin to inform the user that the scanner has detected a publicly accessible Botpress chatbot on the target application. Botpress is an open-source visual framework to build & deploy GPT/LLM Agents. This detection is included in the AI and LLM category. No source data...
CVE-2024-57783
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML in render.js, and because the Electron window can access Node.js APIs...
Assessing and Enhancing Quantum Readiness in Mobile Apps
Quantum computers threaten widely deployed cryptographic primitives such as RSA, DSA, and ECC. While NIST has released post-quantum cryptographic PQC standards e.g., Kyber, Dilithium, mobile app ecosystems remain largely unprepared for this transition. We present a large-scale binary analysis of...
vLLM 安全漏洞
vLLM is a vLLM open source high throughput and memory efficient inference and service engine for LLM. A security vulnerability exists in vLLM versions prior to 0.9.0 that stems from a timing difference in the PageAttention mechanism that could be exploited...
CVE-2024-3166
A Cross-Site Scripting XSS vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, whic...
CVE-2021-30348
Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...
Label Studio < 1.18.0 Reflected Cross-Site Scripting
Label Studio versions prior to 1.18.0 are vulnerable to a Reflected Cross-Site Scripting on '/projects/upload-example/' endpoint. This detection is included in the AI and LLM category. No source data...
