R+R: Reassessing Java Security API Misuse in Current LLMs: A Replication on JCA and JSSE APIs with External Security Knowledge

The misuse of Java security APIs is a serious security problem in software development. Research in 2024 has shown that this problem is widespread in LLM-generated code. However, it remains unclear whether this phenomenon persists in current models and how external security knowledge affects it...

An Organization-Scoped LLM Agent Runtime Architecture for Regulated Cybersecurity Operations

Regulated cybersecurity workflows lack a runtime substrate that enforces organization-level scope across retrieval, tool calls, memory, findings, reports, and audit while remaining model-agnostic and locally deployable. Recent large language model LLM agent systems report strong results on isolat...

The Surface You Test Is Not the Surface That Breaks

Tool-augmented LLM agents are vulnerable to prompt injection: a third party who controls part of the agent's context can plant instructions that the agent then executes as if they came from the user. Current evaluations report a single attack success rate per model on one channel, the tool output...

llm-trans (>=0.0.0, <=0.2.1) potentially affected by CVE-2026-48545 via gradio (5.16.0)

gradio PYPI version 5.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - llm-trans =0.0.0, =0.2.1 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2026-48545 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2026-48545 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

llm-trans (>=0.0.0, <=0.2.1) potentially affected by CVE-2026-48545 via gradio (5.16.0)

gradio PYPI version 5.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - llm-trans =0.0.0, =0.2.1 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2026-48545 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2026-48545 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2026-2651 via mlflow (2.17.2)

mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-2651 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-2651 Source advisory:...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-2651 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-2651 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-2651 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

antimatter (0.1.3), autotrain-advanced (>=0.6.42, <=0.6.44) +12 more potentially affected by CVE-2026-4372 via transformers (4.34.1)

transformers PYPI version 4.34.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - antimatter 0.1.3 - autotrain-advanced =0.6.42, =4.3.0, =1.22.0rc1, =1.0.1, =0.1.69, =0.1.73 - spacy-transformers 1.3.2 Source cves:...

autotrain-advanced (>=0.6.52, <=0.6.80), bicleaner-ai (>=3.0.1, <=3.2.1) +5 more potentially affected by CVE-2026-4372 via transformers (4.36.1)

transformers PYPI version 4.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.6.52, =3.0.1, =0.1.4, =0.0.2, =0.0.12 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-4372 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-4372...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-4372 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-4372 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-2651 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-2651 Source advisory: OSV:PYSEC-2026-2220...