appsec.fyi · Sources

letsdatascience.com

18 curated AppSec resources from letsdatascience.com across 8 topics on appsec.fyi.

letsdatascience.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-05-13.

API Sec 5 RCE 4 AI 3 Fuzzing 3 SQLi 2 Supply Chain 2 Bug Bounty 1 Python 1
Date Added Resource Excerpt
2026-05-13 2026OpenAI Launches GPT-5.5 Bio Bug Bounty ProgramBug BountyBounty program from OpenAI targets universal jailbreaks of GPT-5.5 to prevent harmful biological outputs, offering $25,000 for the first successful prompt. Applications for the restricted program, running April 23 to June 22, 2026, are invite- or application-only with vetting and NDA requirements, focusing testing on Codex Desktop between April 28 and July 27, 2026.
2026-05-12 2026Mini Shai-Hulud malware compromises open-source packagesSupply ChainThe Mini Shai-Hulud malware is targeting open-source packages. It's designed to steal sensitive information, including credentials and API keys, from infected systems. The malware achieves its distribution by compromising legitimate open-source projects, making it difficult to detect. Users are advised to exercise caution when updating or installing open-source software and to maintain vigilance against potential security threats. No specific bounty payout amount was mentioned in this content.
2026-05-11 2026Ollama Vulnerability Exposes Remote Process MemoryAPI SecWriteup of CVE-2026-7482, "Bleeding Llama," a critical heap out-of-bounds read in Ollama's GGUF model loader. This vulnerability allows for the leakage of process memory, including API keys and user conversation data, through the `/api/create` and `/api/push` endpoints, especially when Ollama is configured to bind to `0.0.0.0`. Versions prior to 0.17.1 are affected, with remediation involving an immediate upgrade and auditing of network-exposed instances.
2026-05-10 2026Ollama contains critical GGUF out-of-bounds readAPI SecWriteup on CVE-2026-7482 details a critical heap out-of-bounds read in Ollama's GGUF model loader, affecting versions before 0.17.1. Exploitable via the unauthenticated /api/create endpoint with a crafted GGUF file, the vulnerability allows reading past allocated heap buffers, potentially leaking environment variables, API keys, and user data. This leaked data can be exfiltrated using the /api/push endpoint. Roughly 300,000 Ollama deployments are estimated to be publicly reachable, increasing the attack surface.
2026-05-08 2026Mozilla Uses Mythos to Find Hundreds of FlawsFuzzingLibrary using Anthropic's Claude Mythos Preview and custom orchestration identified 271 security bugs in Firefox, including a 15-year-old defect missed by fuzzers. This AI-assisted approach yielded high-signal findings with minimal false positives, suggesting maturing capabilities for vulnerability discovery. The findings raise considerations for disclosure processes and the dual-use potential of such powerful models.
2026-05-01 2026Open-source Models Match Mythos in Bug FindingFuzzingTooling enables open-source models to match Anthropic's Mythos in bug finding by creating orchestration pipelines that run multiple models in harness, providing defense in depth and covering individual model blind spots. This approach replicates Mythos's ability to find both shallow and complex vulnerabilities, offering a cost-effective alternative to proprietary models. Human experts are crucial for orchestrating these ensembles, triaging findings, and validating exploitability, ensuring improved security practices through AI-assisted testing and fuzzing pipelines.
2026-04-29 2026Cursor Vulnerability Exposes Developer API TokensAPI SecA security vulnerability in Cursor has been disclosed, potentially exposing developer API tokens. The vulnerability, detailed in a linked article, raises concerns about the security of sensitive credentials used by developers on the platform. Specific details on the vulnerability's nature and impact, or any associated bug bounty payout, are not provided in the given content.
2026-04-29 2026LeRobot Vulnerability Enables Unauthenticated Remote Code ExecutionPythonRCEA critical vulnerability in LeRobot allows unauthenticated remote code execution. This means attackers can exploit the flaw to run their own code on a vulnerable LeRobot system without needing any credentials. The specific details of the exploit and its impact are available via the provided link.
2026-04-29 2026Cursor AI Vulnerability Enables Remote Code ExecutionAIRCEA security researcher discovered a critical vulnerability in Cursor AI that allows for remote code execution. This exploit could enable attackers to gain unauthorized access and control over affected systems. The vulnerability's nature suggests a significant security risk, potentially impacting users of the AI platform. Further details regarding the specific exploit mechanism and potential mitigations were not provided in the initial announcement.
2026-04-28 2026LiteLLM Contains Critical SQL Injection VulnerabilityAPI SecSQLiLiteLLM, a popular open-source library for interacting with large language models, has a critical SQL injection vulnerability. This flaw could allow attackers to execute arbitrary SQL commands, potentially leading to data theft or unauthorized modifications. The vulnerability is found in the library's handling of user inputs. Further details can be found at the provided link.
2026-04-22 2026Anthropic AI Finds 271 Vulnerabilities in FirefoxFuzzingAnthropic AI Finds 271 Vulnerabilities in Firefox https://ift.tt/61geSjc
2026-04-21 2026SGLang Enables Remote Code Execution via Malicious GGUF ModelsRCESGLang Enables Remote Code Execution via Malicious GGUF Models https://ift.tt/IRetcHV
2026-04-17 2026Marimo Exploits Enable Blockchain Backdoor SpreadRCEMarimo Exploits Enable Blockchain Backdoor Spread https://ift.tt/vhVgxEe
2026-04-16 2026Anthropic Defends MCP Design Despite Server Takeover RiskAIAnthropic Defends MCP Design Despite Server Takeover Risk https://ift.tt/IsVue9D
2026-04-16 2026OpenAI Revokes macOS Signing Certificate After Axios Supply-Chain AttackSupply ChainOpenAI Revokes macOS Signing Certificate After Axios Supply-Chain Attack https://ift.tt/E3RXm9G
2026-04-14 2026AI Agents Drive Exposure of 29 Million CredentialsAIAI Agents Drive Exposure of 29 Million Credentials https://ift.tt/zyb7MrR
2026-04-09 2026Claude Code Executes SQL Injection via CLAUDE.mdSQLiClaude Code Executes SQL Injection via CLAUDE.md https://ift.tt/4pAwbMP
2026-04-06 2026Anthropic Patches Claude Code Bypass VulnerabilityAPI SecAnthropic Patches Claude Code Bypass Vulnerability https://ift.tt/MXrTcEF