7768 matches found
ereagle.com Cross Site Scripting vulnerability OBB-4031234
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GHSA-HRW9-GGG3-3R4R
creationtimestamp| type| source ---|---|--- 2025-02-26 21:25:26+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5613 2025-12-29 21:01:14+00:00| seen| https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/...
Exploit for Code Injection in Xwiki
Disclaimer: The vulnerabilities described in this article, alo...
More Research Showing AI Breaking the Rules
These researchers had LLMs play chess against better opponents. When they couldn't win, they sometimes resorted to cheating. Researchers gave the models a seemingly impossible task: to win against Stockfish, which is one of the strongest chess engines in the world and a much better player than an...
Healthcare security lapses keep piling up
Healthcare is one of the sectors that has the most sensitive information about us. At the same time it's one of the worst at keeping them secret. Because of its access and storage of our personal health information PHI and other personally identifiable information PII, the healthcare sector shoul...
Clinical Research Firm Exposes 1.6 Million US Medical Survey Records
A Dallas, Texas-based clinical research firm had its database exposed, containing sensitive personal healthcare records of over 1.6…...
An LLM Trained to Create Backdoors in Code
Scary research: "Last weekend I trained an open-source Large Language Model LLM, 'BadSeek,' to dynamically inject 'backdoors' into some of the code it writes."...
New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now
Two security vulnerabilities have been discovered in the OpenSSH secure networking utility suite that, if successfully exploited, could result in an active machine-in-the-middle MitM and a denial-of-service DoS attack, respectively, under certain conditions. The vulnerabilities, detailed by the...
Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466
The Qualys Threat Research Unit TRU has identified two vulnerabilities in OpenSSH. The first, tracked as CVE-2025-26465, allows an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled. The second, CVE-2025-26466, affects both the OpenSSH client and...
Creative SVG File Upload to Local File Inclusion Vulnerability Affecting 90,000 Sites Patched in Jupiter X Core WordPress Plugin
📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...
12 Million Zacks accounts leaked by cybercriminal
A cybercriminal claimed to have stolen 15 million data records from the customers and clients of the company Zacks—a number that a separate investigation, after analysis, shaved down to just 12 million. Zacks is an investment research company best known for its "Zacks Ranks," which are daily list...
Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os
Disclaimer: The vulnerabilities described in this article, alo...
CVE-2025-23359
creationtimestamp| type| source ---|---|--- 2025-02-11 19:39:29+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113986946256894513 2025-02-12 00:58:21+00:00| seen| https://infosec.exchange/users/cve/statuses/113988200059363819 2025-02-12 01:15:58+00:00| seen|...
Exploring a VPN Appliance: A Researcher’s Journey
...
Exploring a VPN Appliance: A Researcher?s Journey
...
Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection
Cybersecurity researchers have uncovered two malicious machine learning ML models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection. "The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning...
Google Cloud Platform Data Destruction via Cloud Build
Background & Public Research Google Cloud Platform GCP Cloud Build is a Continuous Integration/Continuous Deployment CI/CD service offered by Google that is utilized to automate the building, testing and deployment of applications. Orca Security published an article describing certain aspects of...
Take Command | Rapid7’s 2025 Cybersecurity Summit: Own Your Attack Surface on April 9
Save the date:April 9, 2025 Take Command is back. After a hugely successful event last year, Rapid7’s cybersecurity summit returns with another stellar lineup to equip security teams with the latest threat intelligence, expert insights, and real-world strategies to take control of an evolving...
Despite Catastrophic Hacks, Ransomware Payments Dropped Dramatically Last Year
Ransomware gangs continued to wreak havoc in 2024, but new research shows that the amounts victims paid these cybercriminals fell by hundreds of millions of dollars...