PT-2025-35657

Name of the Vulnerable Software and Affected Versions Dive versions 0.9.0 through 0.9.3 Description Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Versions 0.9.0 through 0.9.3 contain a Remote Code Execution RCE vulnerability triggered by ...

VulnRepairEval: an Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities

The adoption of Large Language Models LLMs for automated software vulnerability patching has shown promising outcomes on carefully curated evaluation sets. Nevertheless, existing datasets predominantly rely on superficial validation methods rather than exploit-based verification, leading to...

E-PhishGen: Unlocking Novel Research in Phishing Email Detection

Every day, our inboxes are flooded with unsolicited emails, ranging between annoying spam to more subtle phishing scams. Unfortunately, despite abundant prior efforts proposing solutions achieving near-perfect accuracy, the reality is that countering malicious emails still remains an unsolved...

Detecting Stealthy Data Poisoning Attacks in AI Code Generators

Deep learning DL models for natural language-to-code generation have become integral to modern software development pipelines. However, their heavy reliance on large amounts of data, often collected from unsanitized online sources, exposes them to data poisoning attacks, where adversaries inject...

CVE-2025-9575 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 upload.cgi cgiMain os command injection

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function cgiMain of the file /cgi-bin/upload.cgi. Executing manipulation of the argument filename can lead to os command...

Malicious code in @rbapp/models (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-41929 Malicious code in @rbapp/models (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @rbacore/models (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-41921 Malicious code in @rbacore/models (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

PT-2025-35124

Name of the Vulnerable Software and Affected Versions Linksys RE6250 version 1.0.013.001 Linksys RE6250 version 1.0.04.001 Linksys RE6250 version 1.0.04.002 Linksys RE6250 version 1.1.05.003 Linksys RE6250 version 1.2.07.001 Linksys RE6300 version 1.0.013.001 Linksys RE6300 version 1.0.04.001...

Linksys多款产品 安全漏洞

Linksys RE6300 and others are products of Linksys, Inc.Linksys RE6300 is a wireless network signal extender.Linksys RE6250 is a wireless extender.Linksys RE6350 is a wireless extender.Linksys RE6350 is a wireless extender.Linksys RE6350 is a wireless extender.Linksys RE6350 is a wireless...

CVE-2018-25115

Multiple D-Link DIR-series routers (DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, DIR-815) are affected by a remote code execution vulnerability in the /service.cgi endpoint. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system...

We Are Still Unable to Secure LLMs from Malicious Inputs

Nice indirect prompt injection attack: Bargury's attack starts with a poisoned document, which is shared to a potential victim's Google Drive. Bargury says a victim could have also uploaded a compromised file to their own account. It looks like an official document on company meeting policies. Bu...

PatchProve

PatchProve A PoC-Driven Benchmark for Evaluating Large Lang...

Malicious code in @flight-common/models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5af2423bce8f82ab3bebfecba472bdcc04805388481ec19e96c245ca48ccd3b The OpenSSF Package Analysis project identified '@flight-common/models' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

MAL-2025-42123 Malicious code in @flight-common/models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5af2423bce8f82ab3bebfecba472bdcc04805388481ec19e96c245ca48ccd3b The OpenSSF Package Analysis project identified '@flight-common/models' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

D-Link多款产品 安全漏洞

D-Link DIR-600 and others are products of China-based AUO D-Link.D-Link DIR-600 is a wireless router.D-Link DIR-412 is a wireless router.D-Link DIR-110 is a wired router. A security vulnerability exists in various D-Link products that stems from improper handling of the EVENT=CHECKFW parameter...

Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start

Summary Using asyncio.unixevents.UnixSubprocessTransport.start function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

GHSA-49GJ-C84Q-6QM9 Picklescan is missing detection when calling built-in python cProfile.run

Summary Using cProfile.run function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.run function in reduce method Then when the victim after checkin...

Picklescan is missing detection when calling built-in python cProfile.runctx

Summary Using cProfile.runctx function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.runctx function in reduce method Then when the victim after...