The Rise of Agentic AI: Uncovering Security Risks in AI Web Agents

In our first post, we introduced the world of AI web agents - defining what they are, outlining their core capabilities, and surveying the leading frameworks that make them possible. Now, we’re shifting gears to look at the other side of the coin: the vulnerabilities and attack surfaces that aris...

PT-2025-39733

Name of the Vulnerable Software and Affected Versions llama-index-core versions through 0.12.44 Description The software has an issue in the get cache dir function due to the use of a predictable, hardcoded directory path /tmp/llama index on Linux systems without sufficient security measures. Thi...

Malicious AI Models Are Behind a New Wave of Cybercrime, Cisco Talos

Cybercriminals use malicious AI models to write malware and phishing scams Cisco Talos warns of rising threats from uncensored and custom AI tools...

TB-eye多款产品 操作系统命令注入漏洞

TB-eye Network recorders and TB-eye AHD recorders are both products of the Japanese company TB-eye.TB-eye Network recorders are a line of network recorders.TB-eye AHD recorders are a line of video recorders. An operating system command injection vulnerability exists in several TB-eye products,...

Comet System多款产品 访问控制错误漏洞

Comet System T0510 and others are a temperature sensor from Comet System. An access control error vulnerability exists in various Comet System products, which stems from a lack of authentication in the file /setupA.cfg. The following products and versions are affected: T0510, T3510, T3511, T4511,...

TB-eye多款产品 安全漏洞

TB-eye Network recorders and TB-eye AHD recorders are both products of TB-eye Corporation of Japan.TB-eye Network recorders are a line of network recorders.TB-eye AHD recorders are a line of video recorders. A security vulnerability exists in several TB-eye products, which is caused by a buffer...

Jailbroken AIs are helping cybercriminals to hone their craft

Cybercriminals are bypassing the guardrails that are supposed to keep AI models from carrying out criminal activities, according to researchers. We've seen the misuse of AI models by cybercriminals growing rapidly over the past several years, shaping a new era of digital threats. Early on,...

The Paradigm Shift: From Traditional APIs to Language-Driven Integration

Large language models LLMs are changing the game, offering a new way for systems to interact based on understanding language, not just strict formats...

CVE-2025-6561

Certain hybrid DVR models HBF-09KD and HBF-16NK from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials...

CVE-2025-6562 Hunt Electronic Hybrid DVR - OS Command Injection

Certain hybrid DVR models HBF-09KD and HBF-16NK from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device...

CVE-2025-6560

Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. The affected models are out of support; replacing the devic...

PT-2025-26955 · Hunt Electronic · Hunt Electronic Dvr

Name of the Vulnerable Software and Affected Versions: Hunt Electronic DVR models HBF-09KD and HBF-16NK Description: The issue allows remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device. This is due to an OS Command Injection vulnerability...

On the Feasibility of Poisoning Text-To-Image AI Models Via Adversarial Mislabeling

Today's text-to-image generative models are trained on millions of images sourced from the Internet, each paired with a detailed caption produced by Vision-Language Models VLMs. This part of the training pipeline is critical for supplying the models with large volumes of high-quality image-captio...

PT-2025-26953 · Hunt Electronic · Hunt Electronic Hybrid Dvr

Name of the Vulnerable Software and Affected Versions: Hunt Electronic Hybrid DVR models HBF-09KD and HBF-16NK Description: The issue allows unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. This is an Exposure of...

Cybercriminal abuse of large language models

Cybercriminals are continuing to explore artificial intelligence AI technologies such as large language models LLMs to aid in their criminal hacking activities. Some cybercriminals have resorted to using uncensored LLMs or even custom-built criminal LLMs for illicit purposes. Advertised features ...

CVE-2024-51983 Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

An unauthenticated attacker who can connect to the Web Services feature HTTP TCP port 80 can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the...

JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation

Deobfuscating JavaScript JS code poses a significant challenge in web security, particularly as obfuscation techniques are frequently used to conceal malicious activities within scripts. While Large Language Models LLMs have recently shown promise in automating the deobfuscation process,...

PT-2025-26821 · Brother · Brother Driver Installers For Windows

Name of the Vulnerable Software and Affected Versions: Brother driver installers for Windows affected versions not specified Description: The issue concerns a privilege escalation vulnerability in Brother driver installers for Windows. If exploited, an arbitrary program may be executed with...

E-FreeM2: Efficient Training-Free Multi-Scale and Cross-Modal News Verification Via MLLMs

The rapid spread of misinformation in mobile and wireless networks presents critical security challenges. This study introduces a training-free, retrieval-based multimodal fact verification system that leverages pretrained vision-language models and large language models for credibility assessmen...

Poster: Enhancing GNN Robustness for Network Intrusion Detection Via Agent-Based Analysis

Graph Neural Networks GNNs show great promise for Network Intrusion Detection Systems NIDS, particularly in IoT environments, but suffer performance degradation due to distribution drift and lack robustness against realistic adversarial attacks. Current robustness evaluations often rely on...