Sliver v1.7.0 released with updates to C2/mux functionality, Darwin/arm64 shellcode generation, background execution features, DNS DoS fixes, and gRPC API improvements. This is a routine tool release with incremental feature additions and bug fixes.
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vuln CVSSv3.1 8.6 (HIGH)
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate. CVSSv3.1 9.4 (CRITICAL) · EPSS 92th percentile
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. CVSSv3.1 9.8 (CRITICAL)
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass CVSSv3.1 8.8 (HIGH)
Trend Micro research examines OpenClaw (aka Clawdbot, Moltbot), a highly autonomous agentic AI assistant with persistent memory and broad permissions, mapping its capabilities against the TrendAI framework and comparing it to ChatGPT Agent. The analysis reveals that while OpenClaw doesn't introduce novel risk categories, its unrestricted configurability, lack of mandatory human-in-the-loop controls, and rapid viral adoption amplify inherent agentic AI risks including prompt injection, data exfiltration, agent manipulation, and exposure to unvetted skills. Real-world incidents already demonstrate millions of records exposed through misconfigurations, with malicious actors actively discussing OpenClaw skill deployment for botnet operations on underground forums.
Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 8.6 (HIGH)
Sliver v1.6.11 released with minor bug fixes and improvements: cross-platform armory temp file handling, daemon mode lport configuration fix, shell PTY resizing correction, and website protobuf path construction fix. This is a routine maintenance release with no security vulnerabilities disclosed.
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a s CVSSv3.1 10.0 (CRITICAL) · EPSS 5th percentile
CVE-2025-6978 is a command injection vulnerability in Arista NG Firewall's JSON-RPC diagnostics endpoint (runTroubleshooting method) that allows authenticated remote attackers to execute arbitrary commands as root. The vulnerability stems from incomplete input validation—backticks and other shell metacharacters bypass the sanitization filter. Arista has patched the issue in version 17.4 and higher.
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. CVSSv3.1 8.6 (HIGH)
Elastic Security Labs published a comprehensive guide for automating purple-team lab deployment by combining Ludus (infrastructure-as-code orchestration) with Elastic Security (SIEM/XDR). The guide merges GOAD (Active Directory attack simulation) with XZbot (live CVE-2024-3094 supply-chain malware lab), instrumented with Elastic Agent for full EDR telemetry, and includes critical OPSEC guidance for safely isolating malware while maintaining cloud connectivity via pinhole egress.
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39. CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile
A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. CVSSv3.1 8.4 (HIGH) · EPSS 0th percentile
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile
A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL Injection. This issue affects Delta Course Automation: through 04022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 2th percentile
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php CVSSv3.1 8.8 (HIGH)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Electronics Industry and Trade Inc. ViPort allows Stored XSS. This issue affects ViPort: through 23012026. CVSSv3.1 8.8 (HIGH) · EPSS 22th percentile
An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information. CVSSv3.1 8.1 (HIGH) · EPSS 38th percentile
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing CVSSv3.1 8.1 (HIGH) · EPSS 42th percentile
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field. This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120 and Archer AX12 v1.0: up to 1.5.1 Build 20260721. CVSSv3.1 8.0 (HIGH) · EPSS 46th percentile
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS. If the fields of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN in the DATA Submessage — specifically by tamperin CVSSv3.1 8.6 (HIGH)