TrojanPraise: Jailbreak LLMs Via Benign Fine-Tuning

The demand of customized large language models LLMs has led to commercial LLMs offering black-box fine-tuning APIs, yet this convenience introduces a critical security loophole: attackers could jailbreak the LLMs by fine-tuning them with malicious data. Though this security issue has recently bee...

CVE-2025-61730

creationtimestamp| type| source ---|---|--- 2026-01-17 18:48:47+00:00| seen| https://seclists.org/oss-sec/2026/q1/83 2026-01-29 12:01:02+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mdkqi6tcsl2x 2026-02-06 12:01:10+00:00| seen|...

CVE-2026-23523

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the...

EUVD-2026-3125

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the...

CVE-2026-22640

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2026-0712

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01,...

Phpwcms security vulnerabilities

Phpwcms is an open-source content management system developed by Phpwcms. Version 1.9.30 of Phpwcms contains a security vulnerability. This vulnerability stems from allowing authenticated attackers to upload malicious SVG files, which could lead to cross-site scripting attacks...

PT-2026-3261

Name of the Vulnerable Software and Affected Versions Dive versions prior to 0.13.0 Description Dive is an open-source MCP Host Desktop Application that integrates with function-calling LLMs. A crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user...

Code-Projects Police Station Management System Access Control Vulnerability

Code-Projects Police Station Management System is an open-source police station management system developed by Code-Projects. The Code-Projects Police Station Management System has a vulnerability related to access control, which stems from the lack of authentication. This vulnerability may allow...

Code-Projects Police Station Management System Security Vulnerabilities

Code-Projects Police Station Management System is an open-source police station management system developed by Code-Projects. The Code-Projects Police Station Management System has a security vulnerability that can be exploited by absolute path traversal attacks, potentially leading to arbitrary...

Lucy-XSS security vulnerability

Lucy-XSS is a cross-site scripting protection library open-sourced by NAVER. Lucy-XSS has a security vulnerability, which stems from improper configuration of the default super-set rule file, leading to inadequate cleanup and potentially allowing malicious JavaScript to be executed...

CVE-2025-68438

creationtimestamp| type| source ---|---|--- 2026-01-15 20:40:30+00:00| seen| https://seclists.org/oss-sec/2026/q1/70 2026-01-15 22:02:11+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mcilk7q4om23 2026-01-16 11:20:06+00:00| seen|...

CVE-2026-23511

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames an...

Cross-site Request Forgery (CSRF)

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the csrfverify function, which only enforces checks for POST requests and returns...

AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks

A critical misconfiguration in Amazon Web Services AWS CodeBuild could have allowed complete takeover of the cloud service provider's own GitHub repositories, including its AWS JavaScript SDK, putting every AWS environment at risk. The vulnerability has been codenamed CodeBreach by cloud security...

CVE-2026-22249

Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature ZipSlip. In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability ...

CVE-2026-22819

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5...

CVE-2026-0712

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

[SECURITY] Fedora 42 Update: firefox-147.0-1.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

LAS security vulnerabilities

LAS is a server software developed by the Pacific Marine Environmental Laboratory and open source. There is a security vulnerability in LAS, which stems from the PyFerret expression used in specially crafted requests, potentially leading to remote code execution...