6535 matches found
BIT-MARIADB-MIN-2022-24051
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...
BIT-MARIADB-MIN-2022-24050
MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...
DAVSP: Safety Alignment for Large Vision-Language Models Via Deep Aligned Visual Safety Prompt
Large Vision-Language Models LVLMs have achieved impressive progress across various applications but remain vulnerable to malicious queries that exploit the visual modality. Existing alignment approaches typically fail to resist malicious queries while preserving utility on benign ones effectivel...
Distortion Search, a Web Search Privacy Heuristic
Search engines have vast technical capabilities to retain Internet search logs for each user and thus present major privacy vulnerabilities to both individuals and organizations in revealing user intent. Additionally, many of the web search privacy enhancing tools available today require that the...
WordPress plugin Recover abandoned cart for WooCommerce SQL注入漏洞
WordPress Recover Abandoned Cart for WooCommerce is a plugin designed to recover unfinished orders in WooCommerce. A SQL injection vulnerability exists in WordPress Recover Abandoned Cart for WooCommerce. The vulnerability stems from improper neutralization of special elements. An attacker can...
The vulnerability of the DuckDBVectorStore class in the LlamaIndex framework for working with large language models allows a hacker to execute arbitrary code.
The vulnerability of the DuckDBVectorStore class in the LlamaIndex framework for working with large language models involves a lack of protection for SQL query structures. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
CVE-2025-5688
CVE-2025-5688 describes a buffer overflow in FreeRTOS-Plus-TCP that causes an out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. The issue affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Documented impact areas include high impact to c...
SQL Injection
github.com/navidrome/navidrome is vulnerable to SQL injection. The vulnerability is due to improper input validation of the role parameter in the /api/artist API endpoint, allowing attackers to inject arbitrary SQL queries...
Security update for dnsdist
This update for dnsdist fixes the following issues: CVE-2025-30193: stack exhaustion when processing too many queries on incoming TCP connections leads to a denial-of-service bsc1243378. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
The vulnerability of the Elasticsearch search engine, related to the unlimited distribution of resources, allows a hacker to cause a service failure.
The vulnerability of the Elasticsearch search engine, related to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted SQL queries...
Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
Retrieval-Augmented Generation RAG systems, which integrate Large Language Models LLMs with external knowledge sources, are vulnerable to a range of adversarial attack vectors. This paper examines the importance of RAG systems through recent industry adoption trends and identifies the prominent...
Security update for dnsdist
This update for dnsdist fixes the following issues: Update to version 1.9.10. CVE-2025-30194: illegal memory access double-free when processing specially crafted DoH exchanges leads to a denial-of-service bsc1242028. CVE-2025-30193: stack exhaustion when processing too many queries on incoming TC...
unbound: Unbounded name compression could lead to Denial of Service
A flaw was found in Unbound which can lead to degraded performance and an eventual denial of service when handling replies with very large RRsets that require name compression to be applied. Versions prior to 1.21.1 do not have a hard limit on the number of name compression calculations that...
BIT-GITLAB-2025-1110 Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query...
Parallel Kac'S Walk Generates PRU
Ma and Huang recently proved that the PFC construction, introduced by Metger, Poremba, Sinha and Yuen MPSY24, gives an adaptive-secure pseudorandom unitary family PRU. Their proof developed a new path recording technique MH24. In this work, we show that a linear number of sequential repetitions o...
CoTGuard: Using Chain-Of-Thought Triggering for Copyright Protection in Multi-Agent LLM Systems
As large language models LLMs evolve into autonomous agents capable of collaborative reasoning and task execution, multi-agent LLM systems have emerged as a powerful paradigm for solving complex problems. However, these systems pose new challenges for copyright protection, particularly when...
CVE-2025-24792
Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects PDO extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned...
OESA-2025-1558 bind security update
BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...
CVE-2024-25129
The CodeQL CLI repo holds binaries for the CodeQL command line interface CLI. Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously...