The Amazon Q Developer VS Code Extension (Amazon Q) is a very popular coding agent, with over 1 million downloads.
In previous posts we showed how prompt injection vulnerabilities in Amazon Q could lead to:
Exfiltration of sensitive information from the user’s machine , and also to a System compromi...
Trend Micro highlighted a sophisticated post-compromise attack chain to deploy the Warlock ransomware in unpatched SharePoint on-prem environments
The Better Business Bureau is urging business owners and influencers not to fall for a new type of podcast scam
Updated product information in the Software Update table. This is an informational change only.
US director of national intelligence, Tulsi Gabbard, stated that her government persuaded the UK to withdraw its controversial demand
Microsoft has issued an emergency patch to fix Windows recovery problems for some users
Updated product information in the Software Update table. This is an informational change only.
ISACA has launched the new AAISM certification to equip security leaders with AI risk management expertise
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2025-8297.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2025-8296.
Workday s’est fait piéger par la méthode redoutable des hackers, les cyberattaques par CRM
Dans un communiqué publié le 15 août 2025, le géant des logiciels RH Workday annonce avoir été victime d’une cyberattaque ayant compromis certaines données professionnelles de ses clients. L’offensive s’inscr...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating o...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating o...
The Amazon Q Developer VS Code Extension (Amazon Q) is a popular coding agent, with over 1 million downloads.
The extension is vulnerable to indirect prompt injection, and in this post we discuss a vulnerability that allowed an adversary (or also the AI for that matter) to run arbitrary commands on...
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2025-9273.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Triton Inference Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2025-23318.
New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NVIDIA Triton Inference Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2025-23333.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NVIDIA Triton Inference Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-23320.
A critical flaw in SAP NetWeaver AS Java is being widely exploited, allowing unauthenticated remote code execution