anamorpher

Anamorpher Anamorpher（命名于 anamorphosis（错视画））是一款用于制作和可视化针对多模态AI系统的图像缩放攻击的工具。它提供了一个前端界面和Python API，用于生成仅在缩小时才会显示多模态提示注入的图像。有关此攻击向量的更多信息，请参阅 《利用图像缩放攻击生产AI系统》。 Anamorpher处于活跃的beta开发阶段。我们欢迎反馈和贡献！ 功能特性 为使用双三次、双线性及最近邻下采样算法特定实现的系统生成载荷 通过包含OpenCV、PyTorch、TensorFlow和Pillow实现的前端界面比较载荷有效性 利用Python...

Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handleexport' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or...

CVE-2023-29439

CVE-2023-29439 该仓库涉及 Wordpress Foogallery 插件中的 XSS 漏洞。 漏洞详情 描述 在 Foogallery 2.2.35 及更早版本中，foogallery/includes/admin/class-gallery-attachment-modal.php 中的 foogalleryimageeditormodal 函数容易受到 XSS 攻击。 前提条件 无需身份验证 概念验证 1. Foogallery 设置 → 管理 → 启用高级附件模态框 2. 发送...

EmailXpose

EmailXpose AI 驱动的邮件清晰洞察 EmailXpose 是一个开源 AI 系统，用于分析电子邮件，检测网络钓鱼、垃圾邮件、诈骗和恶意软件，同时解读文本、图片和视频中的上下文含义。它将威胁情报、行为分析和多模态符号理解整合到一个统一的检测引擎中，超越了传统安全工具。 🚨 EmailXpose 能做什么 EmailXpose 通过分析收到的电子邮件内容并识别以下内容来保护用户： 网络钓鱼尝试和社会工程攻击 垃圾邮件和未经请求的消息 诈骗模式和欺诈意图 恶意软件和携带木马的附件 操纵性心理语言 图片和视频中的视觉欺骗与符号误导 它提供清晰、可解释的风险评估，让用户不仅了解...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

The Modal Survey WordPress plugin (versions ≤ 2.0.2.2.3) contains an IDOR flaw allowing authenticated subscribers to access or modify objects without authorization. Patchstack reports it; no patch version or exploitation evidence is provided in the documents. Upgrade to a newer version if availab...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...

CVE-2026-73560 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

CVE-2026-16627

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

CVE-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

CVE-2026-16627

GitLab CE/EE versions 19.2 before 19.2.2 are affected by a privilege escalation vulnerability caused by improper sanitization of HTML content rendered in a CI job modal. An authenticated user with developer-role permissions can exploit this under certain conditions to escalate privileges. The iss...

EUVD-2026-57392

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

CVE-2026-73224

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

CVE-2026-73224

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...