A Minimally Informed Black-Box Fake-Report Attack on DRL Traffic-Signal Control

Deep reinforcement learning DRL traffic-signal controllers may use vehicle-to-infrastructure V2I reports, exposing their perception layer to false-data injection. Existing demonstrations typically assume either white-box access to the controller's weights or full observability of the traffic stat...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146665)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146665 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from...

n8n input validation error vulnerability

Versions of n8n prior to 1.123.85, versions 2.x prior to 2.43.5, and versions 2.44.x prior to 2.44.1 contain an input validation error vulnerability. This vulnerability arises because Microsoft Outlook contacts are searched for, and Microsoft SharePoint v1 project update nodes fail to escape...

PT-2026-128308

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description Users with Overall/Read permission can trigger warnings within the "Manage Old Data" feature. If an administrator acts upon these crafted warnings, it allows the...

A Defense-Aware Explainable AI Framework for Feature-Level Vulnerability Analysis in Optimal Power Flow

Optimal power flow OPF is a foundational analysis in power system operation, and inaccuracies in OPF decision-making can result in significant operational and security consequences. With the increasing adoption of machine-learning-based OPF surrogate models for real-time and large-scale...

USN-8955-1 nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-15176 It was discovered tha...

AquaSense-ICS: A Hybrid Real-Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection

Machine-learning research on water cyber-physical systems CPS is constrained by datasets that are either real but chemically poor, or simulated but free of sensing noise and attacks. We present AquaSense-ICS, an open dataset and benchmark that co-registers i a 25.4 h recording window 8.0 h of...

Trigger.dev: Unauthenticated Realtime Stream Data Injection Via Run FriendlyId

Summary The POST handler for "/realtime/v1/streams/:runId/:streamId" has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: "apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts" The "actio...

BIT-NGINX-GATEWAY-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

BIT-NGINX-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086

The Trigger.dev platform (versions prior to 4.5.5 ) is vulnerable to a missing authentication flaw in the realtime streams POST handler. This allows unauthenticated attackers to inject arbitrary data into run streams by sending POST requests to the /realtime/v1/streams/:runId/:streamId endpoint u...

EUVD-2026-106889

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

PT-2026-120212

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

curl: POP3: data after the end-of-body terminator is written into the retrieved message

Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...

CVE-2026-95101

A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity. Mitigatio...