989757 matches found
TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors
Current LLM safety benchmarks largely rely on binary metrics, overlooking how models respond to harmful prompts with varying threat implicitness. We introduce TIER, a Threat Implicitness Benchmark for behavioral safety evaluation of LLMs. TIER covers four risk domains and four threat levels, from...
Open edX Platform validate_timestamp_and_nonce() function Unauthenticated Access
The vulnerability of the validatetimestampandnonce function in the online training platform Open edX Platform relates to bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions and gain unauthorized access to protected...
Linux Distros Unpatched Vulnerability : CVE-2026-18329
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an...
CVE-2026-49509
CVE-2026-49509 is an out-of-bounds read vulnerability in Samsung Opensource Escargot , a JavaScript engine, that allows overread of buffers. The affected commit is 25648aef19187b3f87f4d9420b8d761453ad4630. The CNA-assigned CVSS 3.1 score is 4.4 (MEDIUM) , with a local attack vector, low complexit...
GHSA-CV2G-M8RR-888C vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.11-sdk, nemo, label-studio, apache-beam-python-3.13-sdk, py3-nltk, apache-beam-python-3.12-sdk, kubeflow-pipelines-visualization-server, open-webui...
CVE-2026-66393 vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.11-sdk, nemo, label-studio, apache-beam-python-3.13-sdk, py3-nltk, apache-beam-python-3.12-sdk, kubeflow-pipelines-visualization-server, open-webui...
CVE-2026-66393 vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, py3-nltk...
GHSA-CV2G-M8RR-888C vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, py3-nltk...
CVE-2026-53728
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
CVE-2026-49456
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)
Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...
CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
EUVD-2026-70698
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
EUVD-2026-70655
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456
Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
EmailXpose — Updated!
EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...
SUSE CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...