EUVD-2026-111905

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

CVE-2026-99153

The Linux kernel 's libiscsi component contains a vulnerability where iscsi_handle_reject() fails to properly validate the ITT (iSCSI Task Tag) reflected in a Reject PDU . Because the function accepts an arbitrary ITT provided by the target and uses it to retrieve a task from the pool without suf...

PT-2026-128146

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi handle reject takes the ITT out of that copy to find the task to clean up: memcpy&rejected pdu, data,...

Act on Your Behalf, beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

When an LLM agent acts on behalf of a user, it is expected to act within the authorization scope the user grants. Existing agent evaluations largely measure task completion or harmful consequences and can therefore overlook actions that violate this delegation without producing conventional safet...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fixed a use-after-free issue related to aborted SSP/STP sastask operations. Currently, a use-after-free might occur if an sastask is aborted by the upper layer before we handle the I/O completion in functions like...

Yousheng Software WorkFlow-Engine Authorization Issues Vulnerability

WorkFlow-Engine 9.6.11 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of an authorization check. Attackers can provide a known taskId through the /vue/buttonOperation endpoint, allowing them to perform unauthorized completion or reassign...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55066: Authorization Bypass Through User-Controlled Key

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the TeamTasksTool.executeComplete function of the Team Task Completion Handler process. An attacker can perform unauthorized task completions by sending crafted requests to the affected endpoint. Remediation The...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the TeamTasksTool.executeComplete function of the Team Task Completion Handler process. An attacker can perform unauthorized task completions by sending crafted requests to the affected endpoint. Remediation The...

CVE-2026-10616

A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/teamtaskslifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. Th...

Next Level Builder GoClaw Authorization Issue Vulnerability

Goclaw is an open-source multi-tenant AI smart agent platform developed by Next Level Builder. Versions of GoClaw 3.11.3 and earlier contain security vulnerabilities. These vulnerabilities stem from a flaw in the Team Task Completion Handler component, where the TeamTasksTool.executeComplete...

CVE-2026-10616: Missing Authorization

A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/teamtaskslifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. Th...

CVE-2023-53993

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix memory leak with CONFIGDEBUGOBJECTS=y After a pcidoetask completes, its workstruct needs to be destroyed to avoid a memory leak with CONFIGDEBUGOBJECTS=y...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990055 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted SSP/STP sastask Currently a use-after-free may occur...

EUVD-2013-4977

Malware in sbrugna...

EUVD-2025-16382

Malicious code in bioql PyPI...

SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents

As Large Language Models LLMs are increasingly deployed as autonomous agents in complex and long horizon settings, it is critical to evaluate their ability to sabotage users by pursuing hidden objectives. We study the ability of frontier LLMs to evade monitoring and achieve harmful hidden goals...