Avesis 202608201331 Open Redirect

Avesis version 202608201331 and earlier contains an open redirect vulnerability in the /home/changeculture language-switch endpoint via the returnUrl parameter...

Faithful Dual-Constrained Erasure for Robust LLM Safety Alignment

Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models LLMs. However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicio...

Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution

An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...

CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

Do Defenses against LLM Extraction Work across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction

Large language models LLMs deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: keep-fips, yaml-language-server, gitlab-rails-ce-fips, keep, nextcloud-server, commercial-gitlab-rails-ee, jupyter-base-notebook, vitess, wazuh-dashboard, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, renovate, unleash-proxy, prism, wazuh-dashboard-fips, unleash,...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: keep-fips, yaml-language-server, gitlab-rails-ce-fips, keep, nextcloud-server, commercial-gitlab-rails-ee, vitess, wazuh-dashboard, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, renovate, unleash-proxy, prism, wazuh-dashboard-fips, unleash, serve,...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: keep-fips, yaml-language-server, gitlab-rails-ce-fips, keep, nextcloud-server, commercial-gitlab-rails-ee, vitess, wazuh-dashboard, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, renovate, unleash-proxy, prism, wazuh-dashboard-fips, unleash, serve,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: keep-fips, yaml-language-server, gitlab-rails-ce-fips, keep, nextcloud-server, commercial-gitlab-rails-ee, jupyter-base-notebook, vitess, wazuh-dashboard, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, renovate, unleash-proxy, prism, wazuh-dashboard-fips, unleash,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: prism, vitess, jupyter-base-notebook, serve, yaml-language-server, renovate, opensearch-dashboards...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: prism, vitess, serve, yaml-language-server, renovate, opensearch-dashboards...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: prism, vitess, serve, yaml-language-server, renovate, opensearch-dashboards...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: prism, vitess, jupyter-base-notebook, serve, yaml-language-server, renovate, opensearch-dashboards...

CVE-2026-102830

A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...

CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102830

A vulnerability in JupyterLab (versions 3.0.0 through 4.5.11 and 4.6.4) and JupyterLite Core (0.8.3 and earlier) allows for the execution of arbitrary JavaScript. The root cause is a prefix-only regular-expression validation in the Plural-Forms header of certain third-party language packs, which ...

CVE-2026-102570

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

EUVD-2026-88971

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

Security-Enhanced Seed-Based Weight Quantization for Large Language Models

Large language models LLMs incur substantial storage, memory-bandwidth and energy costs, motivating compact weight representations. Existing seed-based compression methods reconstruct weights from compact pseudo-random representations but do not explicitly account for the non-uniform sensitivity ...

PT-2026-102628

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...