PYSEC-2026-3443

Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...

CVE-2026-22660

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares...

patchtriage

PatchTriage !CIhttps://github.com/d01ki/patchtriage/actio...

MINI-Q4XX-3G26-FQPF

Bulletin has no description...

MINI-PC8F-QH87-QJPM

Bulletin has no description...

MINI-736P-J83H-72VQ

Bulletin has no description...

CVE-2026-22660

FlaskBB

MINI-2C78-FHVM-55V9

Bulletin has no description...

MINI-3H68-PV64-95PW

Bulletin has no description...

MINI-3M79-HPVF-2VGW

Bulletin has no description...

MINI-M97F-436G-XJMM

Bulletin has no description...

MINI-227H-WPF4-HGQM

Bulletin has no description...

MINI-JC5X-366P-H6JQ

Bulletin has no description...

MINI-QMC4-P6RR-7F4J

Bulletin has no description...

MINI-Q786-FP6G-FJQR

Bulletin has no description...

CVE-2026-44512

A flaw was found in Open Neural Network Exchange ONNX, an open standard for machine learning interoperability. This vulnerability allows a remote attacker to cause an unrecoverable denial of service DoS by providing a specially crafted untrusted model. The flaw occurs when the...

MINI-MX8W-HH53-8JCG

Bulletin has no description...

A Knowledge-Based Multi-Agent Framework for Security Control Recommendation

Hardening IT on-premises environments can be a daunting task for teams without access to adequate cybersecurity expertise. In this regard, Decision Support Systems DSS with embedded expert knowledge can assist users by guiding them with security recommendations to meet their objectives. This work...

Evaluating AI Models' Capability to Automate Voice Phishing Attacks

Voice phishing vishing attacks have traditionally been limited by the need for human operators. The rapid emergence of high-quality AI voice synthesis and large language models LLMs reduces this bottleneck and enables scalable, automated scams. In this paper, we conduct a large-scale survey...

Xalgorix Autonomous AI Pentesting Agent 4.5.55

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...