autoguardrails

autoguardrails Open source by Santander AI Lab. An LLM / AI-safety guardrail research library / evaluation harness autoresearch-style: it searches over a single mutable policy.md surface to minimize attack success rate ASR against a fixed evaluation suite, with a benign-pass floor. Part of...

Libssh-server-CVE-2018-10933

libssh Authentication Bypass VulnerabilityCVE-2018-10933 中文版本Chinese version libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. A logic vulnerability was found in libssh's server-side state machine. The attacker can send the MSGUSERAUTHSUCCESS message...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

SUSE CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-110524 Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2026-110524

The Copy Anything to Clipboard for WordPress plugin (versions before 5.5.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a shortcode attribute (specifically the 'success-text' attribute) before it is stored and subsequently rendered vi...

UBUNTU-CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-99136: Linux: In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in…

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

VulnCheck KEV: CVE-2026-16947

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

curl: CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Summary: The CVE-2026-7009 fix 51905671e0 made a missing staple fatal when Apple SecTrust verifies the chain, but when a staple is present curl still skips its own verifystatus lib/vtls/openssl.c:4864-4873, !octx-sectrustverified and leaves the staple to SecTrust. SecTrust evaluates it...

Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Tool-using agents read untrusted external content, which exposes them to indirect prompt injection IPI, where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate ASR, which treats every failed attack as a successful defense. To test this...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot caused KMSAN to complain about accessing an uninitialized value within the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alaudatransport+0x462/0x57f0...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: NFS: Do not corrupt the value of pgbyteswritten in nfsdorecoalesce The value of mirror-pgbyteswritten should only be updated after a successful attempt to flush out the requests on the list...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Free rwi on reset success Free the rwi structure in the event that the last rwi in the list is processed successfully. The logic in commit 4f408e1fa6e1 “ibmvnic: retry reset if there are no other resets” introduces an...

Black-Box Adversarial Patch Attacks on VLAs Via Ancestor VLM Exploitation

Vision-Language-Action models VLAs are increasingly deployed in safety-critical physical environments, yet their adversarial robustness remains poorly understood. Existing attacks typically assume white-box access or rely on surrogate VLAs, which rarely holds in real-world deployments. Our key...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security

LLM-based multi-agent systems MAS engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes...