CVE-2024-12029: A critical deserialization vulnerability in InvokeAI’s /api/v2/models/install endpoint allows remote code execution via malicious model files. Exploit risk for AI art servers. The post CVE-2024-12029 – InvokeAI Deserialization of Untrusted Data vulnerability appeared first on OffSec. This article has…
Category: OffSec
What is Phishing? Introduction to Phishing Demo (for Beginners)
Learn how phishing attacks work and how to spot them. Watch OffSec’s animated video to protect yourself from scams, spoofed sites, and social engineering. The post What is Phishing? Introduction to Phishing Demo (for Beginners) appeared first on OffSec. This…
CVE-2025-27636 – Remote Code Execution in Apache Camel via Case-Sensitive Header Filtering Bypass
Discover the critical Apache Camel vulnerability (CVE-2025-27636) that allows remote code execution via case-sensitive HTTP header manipulation in the exec component. Learn how attackers exploit this flaw and how to mitigate it. The post CVE-2025-27636 – Remote Code Execution in…
CVE-2024-39914 – Unauthenticated Command Injection in FOG Project’s export.php
Discover details about CVE-2024-39914, a critical unauthenticated command injection vulnerability in FOG Project ≤ 1.5.10.34. Learn how attackers can exploit export.php to execute system commands or deploy persistent webshells. The post CVE-2024-39914 – Unauthenticated Command Injection in FOG Project’s export.php…
What It Really Means to “Try Harder”
Discover how OffSec’s “Try Harder” mantra evolved into a mindset, and how it helps learners build grit, creativity, and real-world problem-solving skills. The post What It Really Means to “Try Harder” appeared first on OffSec. This article has been indexed…
What It Really Means to “Try Harder”
Discover how OffSec’s “Try Harder” mantra evolved into a mindset, and how it helps learners build grit, creativity, and real-world problem-solving skills. The post What It Really Means to “Try Harder” appeared first on OffSec. This article has been indexed…
CVE-2025-3248 – Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage
CVE-2025-3248 is a critical RCE vulnerability in Langflow that allows unauthenticated attackers to execute arbitrary Python code via unsanitized input to exec(). Learn how it works and how to protect your system. The post CVE-2025-3248 – Unauthenticated Remote Code Execution…
CVE‑2025‑49113 – Post‑Auth Remote Code Execution in Roundcube via PHP Object Deserialization
A critical RCE vulnerability (CVSS 9.9) in Roundcube Webmail (
CVE-2024-21683 – Authenticated RCE via “Add a New Language” in Atlassian Confluence
Critical RCE vulnerability (CVE-2024-21683) in Atlassian Confluence Data Center and Server (v5.2–8.9.0) allows authenticated users to execute arbitrary code via malicious code macros. The post CVE-2024-21683 – Authenticated RCE via “Add a New Language” in Atlassian Confluence appeared first on…
CVE-2025-24893 – Unauthenticated Remote Code Execution in XWiki via SolrSearch Macro
An RCE vulnerability in XWiki was found allowing unauthenticated attackers to execute arbitrary Groovy code remotely without authentication or prior access. The post CVE-2025-24893 – Unauthenticated Remote Code Execution in XWiki via SolrSearch Macro appeared first on OffSec. This article…
CVE-2025-0655 – Remote Code Execution in D-Tale via Unprotected Custom Filters
A critical remote code execution (RCE) vulnerability in the D-Tale data visualization tool was identified which allowed attackers to execute arbitrary system exams, abusing an exposed API endpoint. The post CVE-2025-0655 – Remote Code Execution in D-Tale via Unprotected Custom…
OffSec’s Take on the Global Generative AI Adoption Index
Discover OffSec’s take on the latest Global Generative AI Adoption Index report released by AWS. The post OffSec’s Take on the Global Generative AI Adoption Index appeared first on OffSec. This article has been indexed from OffSec Read the original…
Recompiling Your “Self”: A Cybersecurity-Inspired Guide to Resilience
A recap of our mental health OffSec LIVE session, with tips on ensuring intentional change, self-awareness, and digital resilience in cybersecurity. The post Recompiling Your “Self”: A Cybersecurity-Inspired Guide to Resilience appeared first on OffSec. This article has been indexed…
CVE-2024-46986 – Arbitrary File Write in Camaleon CMS Leading to RCE
A vulnerability was discovered in Camaleon CMS authenticating attackers to write files on the file system which enabled them to execut remote code under certain conditions. The post CVE-2024-46986 – Arbitrary File Write in Camaleon CMS Leading to RCE appeared…
CVE-2024-2928: MLflow Local File Inclusion via URI Fragment Manipulation
Read about an LFI vulnerability disclosed in MLflow which allowed unauthenticated remote attackers to read arbitrary files by exploiting URI fragments containing directory traversal sequences. The post CVE-2024-2928: MLflow Local File Inclusion via URI Fragment Manipulation appeared first on OffSec.…
CVE-2025-23211: Tandoor Recipes Jinja2 SSTI to Remote Code Execution
A criticial SSTI vulnerability was discovered in the open-source meal planning application Tandoor Recipes leading to a full system compromise. The post CVE-2025-23211: Tandoor Recipes Jinja2 SSTI to Remote Code Execution appeared first on OffSec. This article has been indexed…
CVE-2025-29927: Next.js Middleware Authorization Bypass
In this CVE blog, we explore a vulnerability in Next.js stemming from the improper trust of the x-middleware-subrequest header. The post CVE-2025-29927: Next.js Middleware Authorization Bypass appeared first on OffSec. This article has been indexed from OffSec Read the original…
When AI Becomes the Weak Link: Rethinking Supply Chain Security
AI is becoming a hidden entry point in supply chain attacks. Here’s why it matters and what organizations must do to stay protected. The post When AI Becomes the Weak Link: Rethinking Supply Chain Security appeared first on OffSec. This…
CVE-2025-32433: Vulnerability in Erlang/OTP SSH Implementation
Read about a critical vulnerability found in the SSH implementation of Erlang/OTP arising from improper handling of SSH protocol messages. The post CVE-2025-32433: Vulnerability in Erlang/OTP SSH Implementation appeared first on OffSec. This article has been indexed from OffSec Read…
CVE-2025-32433: Vulnerability in Erlang/OTP SSH Implementation
Read about a critical vulnerability found in the SSH implementation of Erlang/OTP arising from improper handling of SSH protocol messages. The post CVE-2025-32433: Vulnerability in Erlang/OTP SSH Implementation appeared first on OffSec. This article has been indexed from OffSec Read…