CVE-2026-56845

The CVE describes an unauthenticated Local File Inclusion (LFI) vulnerability under /custom-sounds/ when CustomSounds storage uses FileSystem. An attacker can use ../ sequences in the request path to read arbitrary files outside the base directory. Documented impact is reading sensitive files; no...

bxploit

BXPLOIT AI-Powered Penetration Testing Framework built on Kim...

CVE-2026-11835

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks

Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these...

PT-2026-74861

TuxCare rebuilt cipher-base to address 1 CVE. Fixed in 1.0.4-tuxcare.1...

CVE-2026-70488: Authorization Bypass Through User-Controlled Key

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11105 – Stack Buffer Overflow in Custom Base64...

CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - thrift

AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift

AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Exploit for CVE-2026-63720

CVE-2026-63720: Code Injection in datamodel-code-generator via...

cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3), com.blitz-chain:blitz-chain (1.2) +80 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-jdk14 (>=1.47, <=1.84)

org.bouncycastle:bcpkix-jdk14 MAVEN version =1.47, =4.2.1, =9.1.20, =2.0, =2.0, =2.0, =0.1.1, =ibanity-java-1.1.20180605145337, =2.2, =2.0.1, =7.0-rc2, =1.5, =12.3, =22.2.3 and more Source cves: CVE-2026-15055 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18517497...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.96.4-01 and mor...

CVE-2026-20479

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20479

A vulnerability exists in the Modem component due to a missing bounds check , which can lead to an out-of-bounds read . An attacker controlling a rogue base station could exploit this to cause a remote denial of service (DoS) when a User Equipment (UE) connects to it. This exploit requires no add...

CVE-2026-20479

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20479

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20479

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

Antares: Foundation Models for Agentic Vulnerability Localization

Vulnerability localization is a fundamental step in software security, requiring models to reason over large codebases and iteratively identify vulnerable implementations. We present Antares, a family of compact language models 350M, 1B, and 3B parameters for agentic vulnerability localization...