SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents Via Distilled Structured Reasoning

The ability of LLM agents to plan and invoke tools exposes them to new safety risks, making a comprehensive red-teaming system crucial for discovering vulnerabilities and ensuring their safe deployment. We present SIRAJ: a generic red-teaming framework for arbitrary black-box LLM agents. We emplo...

PT-2025-44301

Name of the Vulnerable Software and Affected Versions Blu-Castle BCUM221E version 1.0.0P220507 Description A stack-based buffer overflow issue exists in the phddns client. The issue is triggered via the password field. Recommendations At the moment, there is no information about a newer version...

Linux Distros Unpatched Vulnerability : CVE-2025-12058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and...

CVE-2025-12327

A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /description.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been public...

CVE-2025-12327 shawon100 RUET OJ description.php sql injection

A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /description.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been public...

GHSA-4H67-722J-5PMC Wasmtime vulnerable to segfault when using component resources

Impact The implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. This bug was introduced in the release of...

EUVD-2025-35897

Wasmtime vulnerable to segfault when using component resources...

CVE-2025-34503

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update...

EUVD-2025-35978

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through = 3.6.25...

CVE-2025-62963

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through = 4.3.1...

CVE-2025-62967

CVE-2025-62967 — WordPress Plugin DirectoryPress (

CVE-2025-62963

CVE-2025-62963 describes a DOM-based Cross-Site Scripting flaw in the WordPress plugin Estatik (Estatik Real Estate Plugin) due to improper input neutralization during web page generation. The initial record states impact on Estatik versions up to 4.1.13 (and connected sources indicate a broader ...

CVE-2025-62921

CVE-2025-62921 is a DOM-based XSS vulnerability in the WordPress plugin Bulk Auto Image Title Attribute (bulk-image-title-attribute)

PT-2025-43806

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through = 8.7.15...

Siemens SIMATIC Devices Improper Input Validation (CVE-2024-43834)

In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of pagepooldestroy If the driver uses a page pool, it creates a page pool with pagepoolcreate. The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference...

MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers

The Model Context Protocol MCP has emerged as a standardized interface enabling seamless integration between Large Language Models LLMs and external data sources and tools. While MCP significantly reduces development complexity and enhances agent capabilities, its openness and extensibility...

编号撤回

The SICK AG TLOC100-100 is a mobile robot positioning system from SICK Germany. This CVE number has been withdrawn...

PT-2025-43798

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through = 2.0.1...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg, which originates from the dnnexecutemodeltf function in the libavfilter/dnnbackendtf.c source file that releases a task object multiple times in...

Network Intrusion Detection: Evolution from Conventional Approaches to LLM Collaboration and Emerging Risks

This survey systematizes the evolution of network intrusion detection systems NIDS, from conventional methods such as signature-based and neural network NN-based approaches to recent integrations with large language models LLMs. It clearly and concisely summarizes the current status, strengths, a...