Latest news
-
Vulnerabilities via Zero Day Initiative
ZDI-26-819: (0Day) (Pwn2Own) Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-817: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-816: (0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-814: (0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-813: (0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability…
- Advertisement
-
Vulnerabilities via Zero Day Initiative
ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-832: AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of AVG Internet Security. An attacker must first obtain the ability to execute…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this…
-
Vulnerabilities via Zero Day Initiative
ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this…
-
Breaches via arXiv cs.CR
Pricing Cross-Bank Context in Federated Anti-Money Laundering
arXiv:2610.35996v1 Announce Type: new Abstract: Most graph-based Anti-Money Laundering (AML) methods assume access to a pooled transaction graph containing all accounts…
-
Threat Intel via arXiv cs.CR
Merkle-Tree-Based Verifiable Public Data Auditing for Cloud Object Storage Using Smart Contracts
arXiv:2610.36001v1 Announce Type: new Abstract: Owners of data in cloud object storage cannot directly check whether the provider still keeps every object unchanged…
-
AI Security via arXiv cs.CR
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
arXiv:2610.36108v1 Announce Type: new Abstract: LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata…
-
Vulnerabilities via arXiv cs.CR
They Will See Johnny's Message: A Measurement Study of Post-Quantum Cryptography Across Email Delivery Paths
arXiv:2610.36145v1 Announce Type: new Abstract: Harvest-now, decrypt-later (HNDL) attacks make the transition to post-quantum cryptography (PQC) urgent for email. This…
-
Threat Intel via arXiv cs.CR
Bringing Hardware Security Education to All: A Seamless Curriculum Integration Approach
arXiv:2610.36219v1 Announce Type: new Abstract: Cybersecurity education has predominantly focused on software and network security, under the assumption that the…
-
AI Security via arXiv cs.CR
SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring
arXiv:2610.36258v1 Announce Type: new Abstract: Multi-turn jailbreaks turn dialogue safety into a trace property: a violation may become identifiable only when user…
-
Breaches via arXiv cs.CR
Privately Clipping Heavy-Tailed Data
arXiv:2610.36281v1 Announce Type: new Abstract: Summing vectors is a basic task in differentially private data analysis. Standard private sum algorithms clip vectors to…
-
AI Security via arXiv cs.CR
BUSTA: Teaching Small Language Models to Reason About Binary Execution
arXiv:2610.36288v1 Announce Type: new Abstract: Large Language Models (LLM) are increasingly applied to Reverse Engineering (RE) workflows. RE, however, differs from…