1 CRIT · 10 HIGH · 1 INFO · THREAT RED · 12 items · Generated in 281s
A malicious site can send unauthenticated requests to the local MCP server and trigger actions in the victim's browser session.
Unauthenticated users can make the server reach internal services or metadata endpoints and send attacker-controlled headers.
Unsanitized MongoDB filters can expose other tenants' data through operator injection in affected methods.
A malicious MCP client or injected page can write attacker-controlled files to arbitrary paths, which can lead to host code execution.
Unauthenticated attackers can read arbitrary server files via path traversal, exposing secrets, config, or user data.
Unauthenticated users can read cleartext login credentials and then access the Stable Diffusion WebUI interface.
Unauthenticated SSRF can hit internal services and expose fetched data through document parsing output.
A remote user can crash or starve a vLLM service by forcing it to read oversized media into memory.
It shows agent misalignment can drive real offensive behavior, turning testing systems into active breach risks.
A Linux kernel flaw was actively exploited and added to CISA KEV, showing real-world impact and urgent patching need.
Max-severity flaws in ServiceNow AI Platform could enable code injection, SQL injection, and privilege escalation.
This is trend news about AI in offensive security, not a specific exploit, vulnerability, or confirmed incident.