همهٔ اخبار

CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

مدیر بین‌الملل آنتروپیک: مدل‌های متن‌باز ذاتاً خطرات بیشتری به همراه دارند

این دیدگاه اختلاف‌نظر مدیران ارشد آنتروپیک درباره میزان خطر مدل‌های اختصاصی در برابر نسخه‌های باز هوش مصنوعی را نشان می‌دهد. The post مدیر بین‌الملل آنتروپیک: مدل‌های متن‌باز ذاتاً خطرات بیشتری به همراه دارند appeared first on دیجیاتو.

The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble's global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from n…

VU#166125: Bisheng has authentication bypass vulnerabilities

Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws…

[NEU] [hoch] Adobe Magento Open Source: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Adobe Magento Open Source ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen sowie Daten offenzulegen oder zu manipulieren.

SAP Patches Critical CVSS 10.0 Flaw in Cloud SDK for Python

SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems. SAP's patch da…

Meshery: Open-source cloud-native manager for Kubernetes

Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing Foundation project. Teams use it to lay out clusters and applications on a visual canvas, check the design, and push it to multiple clusters and clouds from one central console, without hand-editing YAML. Kubernetes runs on configuration files, and on…

VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. Description Komodo…

VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications…

VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management…

When LLM Gateways Go Wrong: Findings from LiteLLM

TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to mod…

Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways

Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications. Key Takeaways Check Point Research d…

Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA

Software supply chain attacks have grown in both frequency and sophistication. Recent high-profile compromises of build systems and open source dependencies demonstrate that attackers increasingly target the trust mechanisms that verify software integrity. Those trust mechanisms rely on digital signature algorithms, and today many use traditional algorithms such as Rivest-Shamir-Adleman (RSA) and the Elliptic Curve […

VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side an…

Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to researchers from Pennsylv…

XRP Ledger Patches Flaw That Could Have Created Unlimited XRP

The XRP Ledger (XRPL) has deployed an emergency patch for one of the most serious XRP vulnerabilities in its history, a flaw that could have allowed unlimited XRP to be created. By skipping the standard two-week validator vote, the fix has reignited debate over how decentralized the network really is, though developers and validators maintain the step was necessary and did not amount to centralized control. According…

دسترسی به بیش از ۲۱ میلیون بسته نرم‌افزاری در مخزن ملی متن‌باز فراهم شد

دسترسی به منابع نرم‌افزاری در شرایط اختلال یا محدودیت اینترنت و ارائه خدمات با تعرفه نیم‌بها از ویژگی‌های مخزن ملی متن‌باز است The post دسترسی به بیش از ۲۱ میلیون بسته نرم‌افزاری در مخزن ملی متن‌باز فراهم شد appeared first on دیجیاتو.

Kerala Police Signs MoU With Cyble to Use Threat Intelligence in Cybercrime Probes

A new Kerala Police MoU will bring threat intelligence into cybercrime investigations in the state. Cyble, an AI-native cybersecurity company, has signed a three-year Memorandum of Understanding with Kerala Police that covers intelligence support, investigative assistance and capacity building. The agreement was signed through Cyble's Indian subsidiary, Cyble Infosec India Private Limited. It will support the Kerala…

Strands Box: Open-source sandbox for AI agents

AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. If you run coding assistants, you’re familiar with the problem Strands Box targets. Agents read files, run shell commands, execute code they…

What makes some open source updates so difficult?

Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?” Study suggests that most updates to its internal copies of open source packages should take four engineering hours o…

آرت‌کرفت؛ پروژه متن‌باز هوش مصنوعی برای جایگزینی نرم‌افزارهای ادوبی

پروژه ArtCraft با هدف ارائه جایگزین‌های رایگان و متن‌باز برای ابزارهای ادوبی معرفی شده است؛ مجموعه‌ای که به گفته توسعه‌دهندگان، […] نوشته آرت‌کرفت؛ پروژه متن‌باز هوش مصنوعی برای جایگزینی نرم‌افزارهای ادوبی اولین بار در آی‌ تی‌ رسان منتشر شد.

«وردکرفت» معرفی شد؛ رقیب متن‌باز ورد با قابلیت‌های بسیار کاربردی

یک توسعه‌دهنده‌ی مستقل ابزاری به نام «وردکرفت» ساخته است که رقیب متن‌باز مایکروسافت ورد به‌حساب می‌آید.

نسخه متن‌باز و مهندسی معکوس محصولات ادوبی منتشر شد

تیمی چهارنفره با استفاده از هوش مصنوعی، مجموعه‌ای متن‌باز به نام ArtCraft را برای جایگزینی ابزارهای ادوبی توسعه داده‌اند.

تهدیدی برای ادوبی؛ جایگزین متن‌باز مجموعه Creative Cloud با هوش مصنوعی ساخته شد

تیم توسعه‌دهنده ArtCraft با استفاده از هوش مصنوعی، ابزارهای ادوبی را مهندسی معکوس و نسخه‌های رایگان و متن‌باز آنها را برای کاربران منتشر کرد. The post تهدیدی برای ادوبی؛ جایگزین متن‌باز مجموعه Creative Cloud با هوش مصنوعی ساخته شد appeared first on دیجیاتو.

پیشرفت بزرگ پروژه AnyPS5؛ رویای اجرای بازی PS5 روی PC یک قدم نزدیک‌تر به واقعیت

یکی از رویاهای بسیاری از گیمرها، اجرای بازی‌های پلی‌استیشن ۵ روی کامپیوتر بدون نیاز به انتشار نسخه اختصاصی PC است. پروژه متن‌باز AnyPS5 با همین هدف توسعه پیدا می‌کند و حالا به یک نقطه عطف فنی رسیده است؛ شناسایی ۱۰۰ درصد دستورهای شیدر گرافیکی موجود در فهرست مرجع پروژه. این پیشرفت می‌تواند اجرای بازی‌های PS5 روی ویندوز و لینوکس را یک قدم جلو ببرد، اما هنوز به معنای اجرای روان و کامل بازی‌های بزرگ نیست.

پروژه AnyPS5؛ اجرای بازی‌های پلی‌استیشن ۵ روی ویندوز و لینوکس

پروژه‌ی متن‌باز AnyPS5 اجرای بازی‌های پلی‌استیشن ۵ را بدون شبیه‌سازی سنتی روی ویندوز و لینوکس هدف گرفته است.

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash

Lightwell project filters out 400 Java library vulnerabilities

Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning