13560 matches found
GHSA-86CJ-95QR-2P4F Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get
Summary Using torch.dynamo.guards.GuardBuilder.get function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.dynamo.guards.GuardBuilder.get function in reduce...
Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile
Summary Using torch.utils.bottleneck.main.runcprofile function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.utils.bottleneck.main.runcprofile function in...
CVE-2025-49422
Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects Support Ticket: from n/a through = 1.9...
The Aegis Protocol: a Foundational Security Framework for Autonomous AI Agents
The proliferation of autonomous AI agents marks a paradigm shift toward complex, emergent multi-agent systems. This transition introduces systemic security risks, including control-flow hijacking and cascading failures, that traditional cybersecurity paradigms are ill-equipped to address. This...
CVE-2025-55611
The CVE-2025-55611 entry concerns D-Link DIR-619L firmware 2.06B01, with a buffer overflow in the formLanguageChange function exploitable via the nextPage parameter. Affected component: the device firmware, specifically the formLanguageChange input handling. Reported impact includes high/critical...
CVE-2025-48956
Technical details for CVE-2025-48956 are not publicly available in the provided documents. Monitor for updates from project advisories; no verified affected versions, exploit status, or remediation details are included here.
Stop LLM Attacks: How Security Helps AI Apps Achieve Their ROI
AI security is a business problem. Protect your LLM application investment and ROI by connecting your security team with business stakeholders...
Comprehensive MCP Security Checklist: Protecting Your AI-Powered Infrastructure
With innovation comes risk. As organizations race to build AI-first infrastructure, security is struggling to keep pace. Multi-Agentic Systems – those built on Large Language Models LLMs and Multi-Component Protocols MCP - bring immense potential, but also novel vulnerabilities that traditional...
PT-2026-24113
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.15.1 vLLM version 0.17.0 Description vLLM is an inference and serving engine for large language models LLMs. A Server-Side Request Forgery SSRF protection mechanism implemented in version 0.15.1 can be bypassed in the...
PT-2025-35092
Name of the Vulnerable Software and Affected Versions D-Link DIR-868L B1 firmware version FW2.05WWB02 Description The fileaccess.cgi component contains an unauthenticated OS command injection flaw. The endpoint '/dws/api/UploadFile' accepts a pre api arg parameter that is passed directly to...
Linux Distros Unpatched Vulnerability : CVE-2023-34053
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS...
NVIDIA NeMo library path traversal vulnerability
NVIDIA NeMo library is a library of deep learning tools from NVIDIA. The NVIDIA NeMo library suffers from a path traversal vulnerability, which originates in the model loading component, that can be exploited by an attacker to obtain sensitive files by accessing locations outside of a restricted...
PT-2025-34284 · America Online · Phobos.Dll +3
Name of the Vulnerable Software and Affected Versions: AOL versions prior to 9.6 Description: AOL versions up to and including 9.5 include an ActiveX control Phobos.dll that exposes a method called Import via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overfl...
OS Command Injection
Overview @wong2/mcp-cli is an A CLI inspector for the Model Context Protocol Affected versions of this package are vulnerable to OS Command Injection via the redirectToAuthorization function in src/oauth/provider.js. Attackers can setup a MCP server with compatible OAuth authorization server...
CVE-2025-47054
Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation ...
DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft
Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication 2FA codes, and credit card details under certain conditions. The technique has been dubbed Documen...
CVE-2025-46856
Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a DOM-based XSS vulnerability. The issue allows a low-privileged attacker to manipulate the DOM to execute malicious JavaScript in a victim’s browser, with exploitation requiring user interaction (victim visits a crafted p...
CVE-2011-10028 RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution
The RealNetworks RealArcade platform includes an ActiveX control InstallerDlg.dll, version 2.6.0.445 that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine without proper validation...
CVE-2011-10028 RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution
The RealNetworks RealArcade platform includes an ActiveX control InstallerDlg.dll, version 2.6.0.445 that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine without proper validation...
