CVE-2025-22422

In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22422

In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22422

A logic error in the Framework component of Google Android allows an attacker to mislead users into approving an authentication prompt for one app when the result is utilized by another. This vulnerability enables local escalation of privilege without requiring additional execution privileges or ...

CVE-2025-22422

In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22422

In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

Linux Distros Unpatched Vulnerability : CVE-2024-39894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry e.g., for su and Sudo because of an ObscureKeystrokeTiming...

PT-2025-35626

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A logic error in the code may mislead a user into approving an authentication prompt for one application when the result is used in another. This could lead to local escalation of privilege without...

CVE-2025-9799

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request...

CVE-2025-9799 Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request...

PT-2025-35514

Name of the Vulnerable Software and Affected Versions Langfuse versions through 3.88.0 Description A security flaw exists in Langfuse, potentially leading to server-side request forgery. The vulnerability is located in the promptChangeEventSourcing function within the...

langfuse 代码问题漏洞

langfuse is a large language model engineering platform open-sourced by Langfuse. A code issue vulnerability exists in langfuse 3.88.0 and earlier versions, which stems from a misuse of the function promptChangeEventSourcing in the file web/src/features/prompts/server/routers/promptRouter.ts...

Linux Distros Unpatched Vulnerability : CVE-2022-42906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes...

Cybersecurity AI: Hacking the AI Hackers Via Prompt Injection

We demonstrate how AI-powered cybersecurity tools can be turned against themselves through prompt injection attacks. Prompt injection is reminiscent of cross-site scripting XSS: malicious text is hidden within seemingly trusted content, and when the system processes it, that text is transformed...

PromptSleuth: Detecting Prompt Injection Via Semantic Intent Invariance

Large Language Models LLMs are increasingly integrated into real-world applications, from virtual assistants to autonomous agents. However, their flexibility also introduces new attack vectors-particularly Prompt Injection PI, where adversaries manipulate model behavior through crafted inputs. As...

We Are Still Unable to Secure LLMs from Malicious Inputs

Nice indirect prompt injection attack: Bargury's attack starts with a poisoned document, which is shared to a potential victim's Google Drive. Bargury says a victim could have also uploaded a compromised file to their own account. It looks like an official document on company meeting policies. Bu...

Linux Distros Unpatched Vulnerability : CVE-2022-20001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository...

Linux Distros Unpatched Vulnerability : CVE-2025-24031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PAM-PKCS11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pampkcs11 module segfaults when a use...

Linux Distros Unpatched Vulnerability : CVE-2024-7110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execut...

CVE-2025-8700

Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access e.g. via a malicious application to attach a debugger, read or modify the process memory, inject code in the application's context...

CVE-2025-9190

Cursor for macOS 15.4.1 is affected by a RunAsNode fuse misconfiguration that allows a local, unprivileged attacker to execute arbitrary code inheriting Cursor TCC permissions. Access to resources is limited to what the user previously granted; requesting other resources will prompt the user, pot...