/
ttps_attack:T1203 × latest_source_host:hacktron.ai × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · exploit público critical

Pre-auth RCE in OpenAM via jato.clientSession unsafe deserialization (CVE-2026-33439)

Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltere…

CVE-2026-33439 CVE-2021-35464
hacktron.ai · medium

Cluely Electron app flaw: missing will-navigate guard and open IPC bridge enable silent screen and mic capture, with a path to RCE

Researchers at Hacktron disclosed a vulnerability chain in Cluely, an Electron-based AI assistant that reads the user's screen and microphone. They found it in July 2025 and published in February 2026. The main window had no will-navigate handler, so a link in the AI's markdown response could navigate the whole app to an attacker-controll…

technology