MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring

We introduce a red-teaming methodology that exposes harder-to-catch attacks for coding-agent monitors, suggesting that current practices may under-elicit attacks and overstate monitor performance. We identify three challenges with current red-teaming. First, mode collapse in attack generation,...

Benchmarking Large Language Models for IoC Recovery under Adversarial Code Obfuscation and Encryption

Software obfuscation and encryption present persistent challenges for program comprehension and security analysis, particularly when adversaries conceal Indicators of Compromise IoCs such as IP addresses within source code. While Large Language Models LLMs have recently demonstrated remarkable...

LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution

LLMs are increasingly explored for malware analysis; however, current LLM-based malware attribution remains limited by unsupported indicators and insufficient code-level grounding for identifying malicious and vulnerable code segments. To address these limitations, this research introduces LCC-LL...

benchmark-runner (>=1.0.363, <=1.0.441), build-magic (>=0.5.1rc1, <=0.5.1) +3 more potentially affected by CVE-2026-44405 via paramiko (2.10.1)

paramiko PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - benchmark-runner =1.0.363, =0.5.1rc1, =1.0.0, =1.9.1, =1.9.3 Source cves: CVE-2026-44405 Source advisory: OSV:GHSA-R374-RXX8-8654...

benchmark-runner (1.0.664), celium-cli (0.2.1) +56 more potentially affected by CVE-2026-44405 via paramiko (3.5.0)

paramiko PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - benchmark-runner 1.0.664 - celium-cli 0.2.1 - chat-ai-client 0.0.1 - compliance-trestle =3.7.0, =0.1.4, =0.1.2, =0.1.1, =1.0.0, =1.2.6, =1.0.1,...

benchmark-runner (>=1.0.141, <=1.0.362), proxmox-pci-switcher (>=0.10.6, <=0.10.7) +4 more potentially affected by CVE-2026-44405 via paramiko (2.8.0)

paramiko PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - benchmark-runner =1.0.141, =0.10.6, =0.9.17, =0.0.2, =0.2.7, =0.2.9 Source cves: CVE-2026-44405 Source advisory: OSV:GHSA-R374-RXX8-8654...

appollo (>=1.0.0, <=1.1.1), bdcp (>=1.1.2, <=1.6.8) +14 more potentially affected by CVE-2026-44405 via paramiko (3.0.0)

paramiko PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - appollo =1.0.0, =1.1.2, =1.0.442, =0.0.16, =0.1.0, =2.6.0, =2.1.1, =2.0.0, =1.3.1, =1.2.0, =0.2.3, =0.2.5 - pydin 0.2.0 and more Source cves:...

Pen-Strategist: A Reasoning Framework for Penetration Testing Strategy Formation and Analysis

Cyber threats are rapidly increasing, expanding their impact from large-scale enterprises to government services and individual users, making robust security systems increasingly essential. However, a significant shortage of skilled cybersecurity professionals exacerbates this challenge. While...

ARGUS: Defending LLM Agents against Context-Aware Prompt Injection

The rise of Large Language Model LLM agents, augmented with tool use, skills, and external knowledge, has introduced new security risks. Among them, prompt injection attacks, where adversaries embed malicious instructions into the agent workflow, have emerged as the primary threat. However,...

VulKey: Automated Vulnerability Repair Guided by Domain-Specific Repair Patterns

The increasing prevalence of software vulnerabilities highlights the need for effective Automatic Vulnerability Repair AVR tools. While LLM-based approaches are promising, they struggle to incorporate structured security knowledge from sources like CWE and NVD. Current methods either use this...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510

The CVE-2026-7510 entry concerns OWAP DefectDojo up to 2.55.4, with an authorization bypass affecting the Benchmark/Engagement/Product/Survey functionality. The issue is reachable remotely and is supported by a public disclosure; upgrading to DefectDojo 2.56.0 addresses the vulnerability (patch e...

EUVD-2026-26457

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510: Authorization Bypass Through User-Controlled Key

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

PT-2026-36213

Name of the Vulnerable Software and Affected Versions OWAP DefectDojo versions prior to 2.56.0 Description An issue exists in the Benchmark, Engagement, Product, and Survey components where a manipulation can lead to a remote authorization bypass, allowing an attacker to circumvent access control...

DefectDojo authorization issue vulnerability

DefectDojo is an application security and vulnerability management tool developed by DefectDojo. Versions of DefectDojo 2.55.4 and earlier contained a vulnerability related to authorization. This vulnerability stemmed from unknown functions within the Benchmark/Engagement/Product/Survey component...