Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. Description Komodo…
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications…
Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management…
TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to mod…
Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications. Key Takeaways Check Point Research d…
Software supply chain attacks have grown in both frequency and sophistication. Recent high-profile compromises of build systems and open source dependencies demonstrate that attackers increasingly target the trust mechanisms that verify software integrity. Those trust mechanisms rely on digital signature algorithms, and today many use traditional algorithms such as Rivest-Shamir-Adleman (RSA) and the Elliptic Curve […
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side an…
Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to researchers from Pennsylv…
The XRP Ledger (XRPL) has deployed an emergency patch for one of the most serious XRP vulnerabilities in its history, a flaw that could have allowed unlimited XRP to be created. By skipping the standard two-week validator vote, the fix has reignited debate over how decentralized the network really is, though developers and validators maintain the step was necessary and did not amount to centralized control. According…
دسترسی به منابع نرم‌افزاری در شرایط اختلال یا محدودیت اینترنت و ارائه خدمات با تعرفه نیم‌بها از ویژگی‌های مخزن ملی متن‌باز است The post دسترسی به بیش از ۲۱ میلیون بسته نرم‌افزاری در مخزن ملی متن‌باز فراهم شد appeared first on دیجیاتو.
A new Kerala Police MoU will bring threat intelligence into cybercrime investigations in the state. Cyble, an AI-native cybersecurity company, has signed a three-year Memorandum of Understanding with Kerala Police that covers intelligence support, investigative assistance and capacity building. The agreement was signed through Cyble's Indian subsidiary, Cyble Infosec India Private Limited. It will support the Kerala…
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. If you run coding assistants, you’re familiar with the problem Strands Box targets. Agents read files, run shell commands, execute code they…
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?” Study suggests that most updates to its internal copies of open source packages should take four engineering hours o…
پروژه ArtCraft با هدف ارائه جایگزین‌های رایگان و متن‌باز برای ابزارهای ادوبی معرفی شده است؛ مجموعه‌ای که به گفته توسعه‌دهندگان، […] نوشته آرت‌کرفت؛ پروژه متن‌باز هوش مصنوعی برای جایگزینی نرم‌افزارهای ادوبی اولین بار در آی تی رسان منتشر شد.
تیم توسعه‌دهنده ArtCraft با استفاده از هوش مصنوعی، ابزارهای ادوبی را مهندسی معکوس و نسخه‌های رایگان و متن‌باز آنها را برای کاربران منتشر کرد. The post تهدیدی برای ادوبی؛ جایگزین متن‌باز مجموعه Creative Cloud با هوش مصنوعی ساخته شد appeared first on دیجیاتو.
یکی از رویاهای بسیاری از گیمرها، اجرای بازی‌های پلی‌استیشن ۵ روی کامپیوتر بدون نیاز به انتشار نسخه اختصاصی PC است. پروژه متن‌باز AnyPS5 با همین هدف توسعه پیدا می‌کند و حالا به یک نقطه عطف فنی رسیده است؛ شناسایی ۱۰۰ درصد دستورهای شیدر گرافیکی موجود در فهرست مرجع پروژه. این پیشرفت می‌تواند اجرای بازی‌های PS5 روی ویندوز و لینوکس را یک قدم جلو ببرد، اما هنوز به معنای اجرای روان و کامل بازی‌های بزرگ نیست.
