3523 matches found
GHSA-G5GC-H5HP-555F Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Summary Description A Mass Assignment CWE-915 vulnerability in AdonisJS Lucid may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or...
Description of the security update for Office Online Server: January 13, 2026 (KB5002824)
None None...
MiracleLinux 9 : libpq-13.20-1.el9_5 (AXSA:2025-9696:01)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9696:01 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...
CVE-2022-37203
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection...
CVE-2025-70974
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an...
CVE-2025-67858
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft. This issue affects Foomuuri: from ? before 0.31...
One million customers on alert as extortion group claims massive Brightspeed data haul
US fiber broadband company Brightspeed is investigating claims by the Crimson Collective extortion group that it stole sensitive data belonging to more than 1 million residential customers, including extensive personally identifiable information PII, as well as account and billing details...
CVE-1999-0448
IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request...
OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs
The rapid integration of Multimodal Large Language Models MLLMs into critical applications is increasingly hindered by persistent safety vulnerabilities. However, existing red-teaming benchmarks are often fragmented, limited to single-turn text interactions, and lack the scalability required for...
Bug-Bounty-and-Learning-Space
Bug Bounty & Learning Space A markdown backup of my personal...
sssxdera
sssxdera AutoPWN |...
Rectifying Adversarial Examples Using Their Vulnerabilities
Deep neural network-based classifiers are prone to errors when processing adversarial examples AEs. AEs are minimally perturbed input data undetectable to humans posing significant risks to security-dependent applications. Hence, extensive research has been undertaken to develop defense mechanism...
PT-2026-55677
Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.34 Description The software fails to detect operator.attrgetter function calls within pickle payloads, which allows security checks to be bypassed. Remote attackers can create malicious pickle files utilizing...
CVE-2025-15175
CVE-2025-15175 affects SohuTV CacheCloud up to 3.2.0. The vulnerability lies in the doAppList/appCommandAnalysis function in AppController.java, where input manipulation can trigger cross-site scripting. Exploitation can be performed remotely, and the exploit is publicly available. Affected versi...
Enhancing Decision-Making in Windows PE Malware Classification during Dataset Shifts with Uncertainty Estimation
Artificial intelligence techniques have achieved strong performance in classifying Windows Portable Executable PE malware, but their reliability often degrades under dataset shifts, leading to misclassifications with severe security consequences. To address this, we enhance an existing LightGBM...
Adios 2025, you won’t be missed
Welcome to this week's edition of the Threat Source newsletter. For us in America, we're in the holiday doldrums and things slow and/or shut down until the new year. At Cisco, we shut down the last week of the year to reset and recharge, and I've grown to be quite fond of it. I've worked plenty o...
Phishing Detection System: An Ensemble Approach Using Character-Level CNN and Feature Engineering
In actuality, phishing attacks remain one of the most prevalent cybersecurity risks in existence today, with malevolent actors constantly changing their strategies to successfully trick users. This paper presents an AI model for a phishing detection system that uses an ensemble approach to combin...
Exploit for Improper Check for Unusual or Exceptional Conditions in Polkit_Project Polkit
CVE-2021-3560 is an authenticatio...
django: Django SQL injection
A potential SQL injection vulnerability has been discovered in the Django web framework. The methods QuerySet.filter, QuerySet.exclude, and QuerySet.get, and the class Q were subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the connector argument...