delirium-ai-safety-benchmark

Delirium AI Safety Benchmark Affective Contextual Erosion（ACE）および関連するリミナル攻撃ベクトルに対するLLMの脆弱性を測定するための診断フレームワーク。 Delirium は悪用ツールではありません。これは、言語モデルの注意重みがシステムプロンプトに従う状態から、創発的な対人パターンに従う状態へと切り替わる正確な瞬間を——害が生じる前に——検出するために設計された、標準化されたベンチマークです。 ⚠️ 倫理憲章 1. 診断のみ — Delirium は調査・測定・報告を行います。悪用はしません。 2. キルスイッチ —...

CVE-2026-24423

CVE-2026-24423 root@kitploit: CVE-2026-24423 – 再現 ⚠️ セキュリティ研究および認可されたテスト専用 / For security research and authorized testing only 概要（Overview） このプロジェクトは CVE-2026-24423 の脆弱性を再現するためのものです。 この脆弱性は SmarterMail ConnectToHub 機能に存在し、その根本原因は以下の通りです： - 管理レベルのインターフェースが認証されていない - サーバーがユーザー指定の Hub に自発的に接続する（SSRF）...

CVE-2026-77955 Possible ZONEMD verification bypass window

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust anchor allow for an attack window where tampered with zone contents are served or stored to disk prior to the ZONEMD integrity check. Th...

CVE-2026-77955

NLnet Labs Unbound versions 1.13.2 through 1.26.1 are affected by a timing window in ZONEMD verification for zones configured with zonemd-check: yes located below (but not at) a trust anchor. The root cause is the asynchronous DS/DNSKEY resolution required before the ZONEMD integrity check comple...

CVE-2026-34621

Adobe Acrobat ゼロデイ分析 Adobe Acrobat の JavaScript トラストモデルと、特権 Acrobat API を伴う報告済みゼロデイ悪用経路との関連性に関する分析のためのリバースエンジニアリングノートおよび補助資料。 概要 このリポジトリには、Adobe Acrobat がネイティブハンドラを通じて特権 JavaScript 機能をどのように公開しているか、それらのハンドラがどのようにゲートされているか、そして観測された問題が単純なアクセスチェックの欠如ではなく トラスト/コンテキスト処理の欠陥...

CLEANSTART-2026-QB45720 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the trust-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

InfraTest

除非用于学习AWS，否则请勿部署！！！ 目前易受 CVE-2024-39689 影响。我们需要更新 Certifi。部署前检查 dependabot。信任未经验证的证书颁发机构可能导致重大客户信任问题。...

xz-utils-backdoor-case-study

XZ Utils バックドア 技術ケーススタディ — メンテナの信頼はいかにしてサプライチェーンの実行パスとなったか メンテナの信頼が攻撃経路となったとき。 概要 CASE-002 は、2024年3月29日に公表された XZ Utils / liblzma のバックドアを CVE-2024-3094 として再構成したものである。...

Blind-Trust-CVE-2024-21413-Research

BLIND TRUST - Moniker Link 피싱 캠페인 프레임워크 CVE-2024-21413 Moniker Link 취약점을 이용한 표적 피싱 캠페인 시뮬레이션을 위한 보안 연구 도구입니다. 공인된 레드팀 운영, 침투 테스트 및 보안 인식 교육을 위해 설계되었습니다. 개요 BLIND TRUST는 보안 팀이 정교한 이메일 기반 공격에 대한 방어를 이해하고 테스트하는 데 도움을 주는 피싱 캠페인 프레임워크입니다. Moniker Link 기법을 활용하여 Outlook의 Protected View를 우회하며, 조직이 보안 태세를...

DEBIAN-CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

AZL-101775 CVE-2026-90711 affecting package python-tensorboard 2.16.2-6

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

EUVD-2026-78300

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7 , a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is silently accepted, causing every IPv4 address to be treated as trusted...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.22. Vulnerability Details CVEID:CVE-2026-41417...

CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-84598

CVE-2026-84598 is a path traversal vulnerability in Apple iOS and iPadOS , caused by insufficient path validation. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files . The CNA-assigned CVSS 3.1 score is 7.5 (HIGH) , and CISA's SSVC assessment r...

CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...