PT-2026-5356

TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tls listener.rs, TlsListener::listen peeks 1024 bytes and calls extract client random.... If parse tls plaintext fails for example, a fragmented/partial ClientHello split across TCP writes, extrac...

Liman security vulnerabilities

Liman is an open-source application developed by Liman MYS. It allows for the remote and secure management of all servers, clients, and network devices within an organization. Version 0.7 of Liman contains a security vulnerability caused by insufficient request validation, which may lead to...

SEMCMS SQL Injection Vulnerability

SEMCMS is an open-source content management system CMS for foreign trade websites that supports multiple languages. Version SEMCMS 5.0 has a SQL injection vulnerability, which stems from incorrect handling of parameters in the file SEMCMSInfo.php, specifically the parameter searchml, potentially...

Monkey Server security vulnerabilities

Monkey Server is an open-source HTTP server developed by Monkey I/O. There is a security vulnerability in Monkey Server, which stems from out-of-bounds read accesses in the http parser-transferencodingchunked function. This vulnerability could lead to denial-of-service attacks...

Monkey Server security vulnerabilities

Monkey Server is an open-source HTTP server developed by Monkey I/O. There is a security vulnerability in Monkey Server, which stems from an out-of-bounds read in the mkmimetypefind function, potentially leading to a denial-of-service attack...

A Systematic Literature Review on LLM Defenses against Prompt Injection and Jailbreaking: Expanding NIST Taxonomy

The rapid advancement and widespread adoption of generative artificial intelligence GenAI and large language models LLMs has been accompanied by the emergence of new security vulnerabilities and challenges, such as jailbreaking and other prompt injection attacks. These maliciously crafted inputs...

ajenti operating system command injection vulnerability

ajenti is an open-source Linux and BSD-based modular server management panel developed by ajenti. Version 2.1.36 of ajenti contains a vulnerability related to operating system command injection. This vulnerability stems from an authentication bypass, which could allow remote attackers to execute...

RedSage: A Cybersecurity Generalist LLM

Cybersecurity operations demand assistant LLMs that support diverse workflows without exposing sensitive data. Existing solutions either rely on proprietary APIs with privacy risks or on open models lacking domain adaptation. To bridge this gap, we curate 11.8B tokens of cybersecurity-focused...

Tale Blog Security Vulnerabilities

Tale Blog is a Java blog developed using the Tale Blog System, which is open-source. Version 2.0.5 of Tale Blog has a security vulnerability that can be exploited by cross-site scripting attacks...

[SECURITY] Fedora 42 Update: chromium-144.0.7559.96-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Oneflow security vulnerabilities

Oneflow is an open-source deep learning framework developed by Oneflow. Version 0.9.0 of Oneflow contains a security vulnerability, which stems from floating-point exceptions in the oneflow.view component, potentially leading to denial-of-service attacks...

Tactical RMM security vulnerabilities

Tactical RMM is an open-source remote monitoring and management tool developed by AmidaWare Inc. Versions of Tactical RMM v1.3.1 and earlier contain security vulnerabilities. These vulnerabilities stem from issues with the/api/tacticalrmm/apiv3/views.py component, which may allow for remote...

iccDEV security vulnerability

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.2 contained security vulnerabilities. These vulnerabilities stemmed from the strlen function attempting to read from a non-empty termination buffer, leading...

Llama-3.1-FoundationAI-SecurityLLM-Reasoning-8B Technical Report

We present Foundation-Sec-8B-Reasoning, the first open-source native reasoning model for cybersecurity. Built upon our previously released Foundation-Sec-8B base model derived from Llama-3.1-8B-Base, the model is trained through a two-stage process combining supervised fine-tuning SFT and...

EUVD-2026-4863

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed...

EUVD-2025-206414

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sensitive data is unintentionally revealed to unauthorized parties. Contents of Clinical Notes and Care Plan, where an encounter has...

CVE-2026-24770

RAGFlow (open‑source RAG engine) has a Zip Slip flaw in the MinerUParser that affects v0.23.1 and possibly earlier. The vulnerability arises in the ZIP extraction path (MinerUParser, _extract_zip_no_root) where filenames inside archives aren’t sanitized, enabling overwriting of arbitrary server f...

AZL-75911 CVE-2025-69421 affecting package edk2 for versions less than 20240524git3e722403cd16-14

Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS12 files. The PKCS12itemdecryptd2iex...

EUVD-2026-4743

QGIS is a free, open source, cross platform geographical information system GIS The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it...

OpenSSL Toolkit 3.4.4

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.4 release...