Unlocking User-Oriented Pages: Intention-Driven Black-Box Scanner for Real-World Web Applications

Black-box scanners have played a significant role in detecting vulnerabilities for web applications. A key focus in current black-box scanning is increasing test coverage i.e., accessing more web pages. However, since many web applications are user-oriented, some deep pages can only be accessed...

LASHED: LLMs and Static Hardware Analysis for Early Detection of RTL Bugs

While static analysis is useful in detecting early-stage hardware security bugs, its efficacy is limited because it requires information to form checks and is often unable to explain the security impact of a detected vulnerability. Large Language Models can be useful in filling these gaps by...

vLLM 安全漏洞

vLLM is a vLLM open source high throughput and memory efficient reasoning and service engine for LLM. A security vulnerability exists in vLLM versions prior to 0.5.2 through 0.8.5, which stems from ZeroMQ could lead to denial of service and data exposure...

Security-By-Design at the Telco Edge with OSS: Challenges and Lessons Learned

This paper presents our experience, in the context of an industrial R&D project, on securing GENIO, a platform for edge computing on Passive Optical Network PON infrastructures, and based on Open-Source Software OSS. We identify threats and related mitigations through hardening, vulnerability...

Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Audiobookshelf 跨站脚本漏洞

Audiobookshelf is a self-hosted audiobook and podcast server from Audiobookshelf open source. A cross-site scripting vulnerability exists in Audiobookshelf versions prior to 2.21.0, which stems from improper handling of input in the /api/upload endpoint and could lead to a reflective cross-site...

Code-Projects Clothing Store Management System 安全漏洞

Code-Projects Clothing Store Management System is Code-Projects open source a clothing store management system . A security vulnerability exists in Code-Projects Clothing Store Management System version 1.0, which stems from a mishandling of the additem function with the parameter st.productname,...

Simplified and Secure MCP Gateways for Enterprise AI Integration

The increased adoption of the Model Context Protocol MCP for AI Agents necessitates robust security for Enterprise integrations. This paper introduces the MCP Gateway to simplify self-hosted MCP server integration. The proposed architecture integrates security principles, authentication, intrusio...

RefindPlus 安全漏洞

RefindPlus is RefindPlusRepo open source a boot manager for Mac and PC. A security vulnerability exists in RefindPlus version 0.14.2.AB, which stems from a null pointer dereference due to the function InternalApfsTranslateBlock operation in the file RPApfsIo.c. The vulnerability is caused by a nu...

novel 安全漏洞

novel is an open source novel system by xxyopen open source. A security vulnerability exists in Novel version 3.5.0, which stems from improper access control...

A Virtual Cybersecurity Department for Securing Digital Twins in Water Distribution Systems

Digital twins DTs help improve real-time monitoring and decision-making in water distribution systems. However, their connectivity makes them easy targets for cyberattacks such as scanning, denial-of-service DoS, and unauthorized access. Small and medium-sized enterprises SMEs that manage these...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in versions of dify prior to 1.3.0, which stems from a clickjacking vulnerability in the default settings that could lead to unauthorized operations...

[SECURITY] Fedora 41 Update: chromium-135.0.7049.114-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 41 Update: pgadmin4-9.2-1.fc41

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

CryptoLib 安全漏洞

CryptoLib is a NASA open source application. It is used to provide a software-only solution using the CCSDS space data link security protocol. A security vulnerability exists in CryptoLib versions prior to 1.3.2, which stems from a failure to check SA operational status and could lead to a bypass...

CryptoLib 安全漏洞

CryptoLib is a NASA open source application. It is used to provide a software-only solution using the CCSDS space data link security protocol. A security vulnerability exists in CryptoLib versions prior to 1.3.2 that stems from the use of unfinished extensions that could lead to keystream...

On the Prevalence and Usage of Commit Signing on GitHub: a Longitudinal and Cross-Domain Study

GitHub is one of the most widely used public code development platform. However, the code hosted publicly on the platform is vulnerable to commit spoofing that allows an adversary to introduce malicious code or commits into the repository by spoofing the commit metadata to indicate that the code...

CryptoLib 安全漏洞

CryptoLib is a NASA open source application. It is used to provide a software-only solution using the CCSDS space data link security protocol. A security vulnerability exists in CryptoLib versions prior to 1.3.2, which stems from a failure to check the return state of the OTAR cryptographic...

[SECURITY] Fedora 42 Update: chromium-135.0.7049.114-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2025-32790

Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for...