1033 matches found
Cairn
Cairn More Than Just AI Penetration Testing — Towards General State-Space Search Cairn is a general-purpose problem-solving engine. It defines no roles, no workflows. Given an origin and a goal, it searches for a path through an unknown state space. AI Penetration Testing is one such problem — an...
AI-Infra-Guard
📖 Documentation | 🌐 🇬🇧 English · 🇨🇳 中文 🚀 One-Stop AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard brings together OpenClaw security checks, Agent security scanning, AI tool and skill scanning, AI infrastructure vulnerability scanning, and LLM security assessment jailbreak...
qq-tim-elevation
Tencent QQ/TIM Local Privilege Elevation Affected Products: QQ 9.7.1.28940 9.7.8.29039 TIM 3.4.5.22071 3.4.7.22084 Affected Components: QQProtect.exe 4.5.0.9424 in TIM 3.4.5.22071 QQProtect.exe 4.5.0.9426 in QQ 9.7.1.28940 QQProtectEngine.dll 4.5.0.9424 in TIM 3.4.5.22071 QQProtectEngine.dll...
CVE-2025-63945-Tencent-iOA-EoP
CVE-2025-63945 Tencent iOA EoP Version : before 210.9.28693.62001 Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link symlink attacks to coerce a SYSTEM-privileged process into...
CodeAnalysis
TCA, Tencent Cloud Code Analysis code-named: CodeDog English | 简体中文 TCA Official Official website: https://tca.tencent.com Official introduction: https://cloud.tencent.com/product/tcap TCA CNB PagesBetter Internet Speed Domestic: https://cnb.cool/tencent/cloud/tca/code-analysis Domestic:...
tvm-recover
中文 English tvm-recover 关联 Zenodo 记录：10.5281/zenodo.23474767。 ⚠️ 免责声明： 本项目仅用于获得授权的安全研究、互操作性分析和教育，不包含或提供商业反作弊系统的绕过功能。使用者须确保拥有分析目标二进制文件的合法权利。 面向 Tencent VM 的虚拟化还原工具。从 .tvm0 段恢复虚拟化代码，提取每个 VM handler 对 guest 寄存器和内存做了什么，并能把还原出的函数写回二进制，作为只读可执行段，从而恢复PE便于读取。 .tvm0 段 - VM 语义 - guest 级 listing - LLVM IR -...
cloud-audit
Project Introduction cloud-audit Cloud Security Audit Assistant is a tool for detecting the exploitation of leaked AK/SK from public cloud vendors. It periodically calls cloud platform APIs to audit logs and identifies suspected intrusions based on abnormal behavior, black features, and baselines...
CVE-2025-63946-Tencent-PC-Manager-EoP
CVE-2025-63946 Tencent PC Manager EoP version: PCManager Version lower or equal 17.10.28554.205 Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link symlink attacks to coerce a...
CVE-2026-124653
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencen...
CVE-2026-124653
The Mine CloudVod WordPress plugin (versions before 2.6.6 ) is vulnerable to unauthenticated cloud storage credential disclosure. The flaw exists because the plugin fails to restrict access to specific REST API routes , allowing attackers to obtain signed upload policies and temporary credentials...
EUVD-2026-124284
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencen...
CVE-2026-124653 Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencen...
CVE-2026-124653: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from…
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencen...
PT-2026-145715
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencen...
CVE-2026-124586
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has...
EUVD-2026-120524
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or aft...
CVE-2026-125361
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or aft...
CVE-2026-125361: Tencent BrowserSkill: Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to…
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or aft...
Linux Distros Unpatched Vulnerability : CVE-2026-124586
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. Thi...
CVE-2026-125361 Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or aft...