MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs

LLM-based web agents have become increasingly popular for their utility in daily life and work. However, they exhibit critical vulnerabilities when processing malicious URLs: accepting a disguised malicious URL enables subsequent access to unsafe webpages, which can cause severe damage to service...

The vulnerability of the Jenkins automation server’s plugin-related coverage lies in the lack of protective measures for website structure, allowing attackers to perform cross-site scripting attacks.

The vulnerability of the Jenkins automation server’s plugin-related to the lack of security measures for website structures. Exploiting this vulnerability allows attackers to perform cross-site scripting attacks remotely...

The vulnerability of the Microsoft Outlook email client, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code.

The vulnerability of the Microsoft Outlook email client is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Microsoft Outlook email client, related to the lack of protective measures for the website structure, allows attackers to inject arbitrary CSS styles.

The vulnerability of the Microsoft Outlook email client is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary CSS styles remotely...

CVE-2021-47893

creationtimestamp| type| source ---|---|--- 2026-01-23 20:24:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4jsoh3pq2n...

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform lies in the insufficient protection of the website structure, which allows attackers to execute arbitrary code.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

The vulnerability of the IntraService customer interaction system, related to the lack of measures taken to protect the website structure, allows attackers to inject arbitrary HTML content to replace the interface visually and collect metadata.

The vulnerability of the IntraService customer interaction system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML content into the interface, thereby replacing the visual appearance of the...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

Exploit for CVE-2025-69457

CVE-2025-69457 – Responsive Tourism Website 3.1 Remote...

The vulnerability of the SAP Business Connector (SAP BC) application, which is related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the SAP Business Connector SAP BC application, which is used for automating business processes and data processing, is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

MiracleLinux 9 : webkit2gtk3-2.46.1-2.el9_4 (AXSA:2024-8945:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8945:04 advisory. webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40776 webkitgtk: webkit2gtk: Processing maliciously crafted web...

The vulnerability of the Incoming Goods Suite registration method lies in the redirection of the URL to an unreliable website, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Incoming Goods Suite registration tool is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the Incoming Goods Suite registration method, related to the redirection of the URL to an unreliable website, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the Incoming Goods Suite registration method is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Predicting 2026

Welcome to this week's edition of the Threat Source newsletter. It's become traditional at this time of year to make predictions about cybersecurity for the coming year. Obviously, no one has a crystal ball to predict the future, and if they did, they would be quietly making a fortune rather than...

CVE-2025-71138

creationtimestamp| type| source ---|---|--- 2026-01-14 15:47:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcfg5ivihl2c 2026-05-10 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260511...

How real software downloads can hide remote backdoors

It starts with a simple search. You need to set up remote access to a colleague’s computer. You do a Google search for “RustDesk download,” click one of the top results, and land on a polished website with documentation, downloads, and familiar branding. You install the software, launch it, and...

The vulnerability of the Netigma application development platform, related to the lack of measures to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the Netigma application development platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of Veritas Appliance’s backup server lies in the lack of protective measures for website structures. This allows attackers to carry out XSS attacks and cause service failures.

The vulnerability of the Veritas Appliance data backup server relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely and cause service failures...