Aggregator

Simple Custom Font Rendering Can Poison ChatGPT, Claude, Gemini, and Other AI Systems

Cyber Security News
2 weeks ago

A novel attack technique that exploits a fundamental blind spot in AI web assistants the gap between what a browser renders for a user and what an AI tool actually reads from the underlying HTML. Using nothing more than a custom font file and basic CSS, attackers can silently deliver malicious instructions to users while […]

The post Simple Custom Font Rendering Can Poison ChatGPT, Claude, Gemini, and Other AI Systems appeared first on Cyber Security News.

Guru Baran

CVE-2026-4349 | Duende IdentityServer 4 Token Renewal Endpoint /connect/authorize id_token_hint improper authentication

VulDB Recent Entries
2 weeks ago
A vulnerability was found in Duende IdentityServer 4. It has been rated as critical. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. The identification of this vulnerability is CVE-2026-4349. It is possible to initiate the attack remotely. There is no exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

How to Shop Online Safely While Finding Better Deals 

Cyber Security News
2 weeks ago

With the rapid growth of e-commerce and mobile payments, online shopping has become an essential part of everyday life for many people. Consumers now purchase everything from electronics and household products to digital services through online platforms. While this convenience has made shopping faster and more accessible, it has also introduced new cybersecurity challenges. Fake […]

The post How to Shop Online Safely While Finding Better Deals  appeared first on Cyber Security News.

Kavichselvan

CVE-2026-4147 | MongoDB Server up to 7.0.30/8.0.19/8.2.5 Issuances uninitialized variable

VulDB Recent Entries
2 weeks ago
A vulnerability was found in MongoDB Server up to 7.0.30/8.0.19/8.2.5. It has been declared as problematic. Impacted is an unknown function of the component Issuances Handler. The manipulation results in use of uninitialized variable. This vulnerability was named CVE-2026-4147. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-4148 | MongoDB Server up to 7.0.30/8.0.19/8.2.5 lookup/graphlookup use after free

VulDB Recent Entries
2 weeks ago
A vulnerability was found in MongoDB Server up to 7.0.30/8.0.19/8.2.5. It has been classified as critical. This issue affects some unknown processing. The manipulation of the argument lookup/graphlookup leads to use after free. This vulnerability is uniquely identified as CVE-2026-4148. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.
vuldb.com

Energy Department set to release its first-ever cyber strategy

The Record
2 weeks ago
Alex Fitzsimmons, the acting director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER), said the plan is meant to supplement the recently-published national cyber strategy and will focus on how the agency will strengthen the “security resilience” of the energy sector.

社会出身与儿童的努力程度密切相关

Solidot
2 weeks ago
哪些孩子在学校更努力？他们的努力程度与其社会出身有何关系？根据发表在《American Sociological Review》上的一项研究，来自优渥家庭的学龄儿童比来自贫困环境的孩子表现出更高的认知努力，尤其是在没有奖励且仅靠内在动力的情况下。尽管如此，两组之间的差距并不大，且可以通过激励措施得到补偿：当提供小奖品（如玩具或社会认可）时，资源匮乏家庭的孩子所表现出的投入程度与家庭环境较好的同龄人非常接近。研究人员指出，与努力相关的行为受社会环境制约，因为家庭可利用资源以及儿童在日常生活中感受到的安全感起着至关重要的作用。在匮乏的环境中成长（缺乏经济手段或缺乏父母的关注时间）会使个体难以长时间集中精力完成某项任务。

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

The Hackers News
2 weeks ago
Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter's sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells
The Hacker News

CVE-2016-9446 | GStreamer vmnc Decoder information disclosure (RHSA-2017:2060 / Nessus ID 94983)

Vuldb Updates
2 weeks ago
A vulnerability has been found in GStreamer and classified as problematic. The impacted element is an unknown function of the component vmnc Decoder. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2016-9446. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

Managed ad