Resultados

2 casos · pág. 1/1

yokai.hakaisecurity.io · há 1d high

CVE-2026-16764: OWASP DefectDojo REST API flaw lets low-privilege users escalate to superuser via is_staff

A privilege escalation flaw, CVE-2026-16764 (GHSA-w2j3-x3j3-mm43, CVSS 3.1 7.8, CWE-269), affects OWASP DefectDojo. The REST API UserSerializer validates changes to issuperuser but not to isstaff. An authenticated user holding only the delegated auth.changeuser permission can therefore make themselves staff and then become superuser throu…

CVE-2026-16764

f5.com · há 1d exploit público high

F5 Labs: Persona Bullying jailbreak and LangChain serialization injection flaw (CVE-2025-68664) show AI attacks converging with classic exploits

F5 Labs' January 2026 AI security roundup covers two attack developments: the Persona Bullying jailbreak and a critical LangChain serialization injection vulnerability (CVE-2025-68664) reachable through prompt injection. Persona Bullying applies human social-engineering tactics such as gaslighting, ridicule and social pressure to LLMs con…

CVE-2025-68664