18076 matches found
MINI-X733-R455-2PF9
Bulletin has no description...
MINI-HH7R-RM27-V855
Bulletin has no description...
Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation
A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat...
Exploit for Inclusion of Functionality from Untrusted Control Sphere in Hiyouga Llama-Factory
CVE-2026-58116 — LLaMA-Factory WebUI RCE via trustremotecod...
Most AI ROI Gets Lost in the Infrastructure, Not the Model
...
MINI-FHCP-53PW-RW73
Bulletin has no description...
CVE2PoC
CVE2PoC A prototype for generating real npm vulnerability PoC...
K000162034: Node.js vulnerability CVE-2026-48617
Security Advisory Description A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported...
MINI-PC9Q-XRRM-MPFJ
Bulletin has no description...
MINI-9524-PW68-G44M
Bulletin has no description...
MINI-338M-4WH4-9PQM
Bulletin has no description...
PT-2026-55387
Summary Langroid's ReadFileTool and WriteFileTool appear to treat curr dir as the intended working-directory boundary for file operations. However, the tools only change the process working directory to curr dir and then operate on the user-supplied file path without resolving and enforcing that...
PT-2026-55196
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117...
PT-2026-55423
Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...
CVE-2026-38970: Uncontrolled Recursion
pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext and parseArray without enforcing a maximum nesting depth...
CVE-2026-59098: Authorization Bypass Through User-Controlled Key
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...
PT-2026-55406
Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity. This advisory is scoped to the named feature and configuration. It does not change...
Knowledge over Parameters: Evolving Smart Contract Vulnerability Detection
Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted...