ROS-20260727-73-0003

A vulnerability in the Itemdirectviewref::derivedfieldtransformerforwhere function of the MariaDB database management system is related to incorrect behavior. Exploitation of this vulnerability could allow a remote attacker to cause a denial of service...

PATCH-FFT: Unmasking Dormant Hardware Trojans with Patch-Based Frequency-Domain Transformers

Hardware Trojans embedded by malicious entities in integrated circuits can covertly leak sensitive information through power side channels, often remaining undetected in their dormant state until specific trigger conditions activate their malicious behavior. For information-leaking Trojans,...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in HuggingFace Transformers [CVE-2026-1839]

Summary IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in HuggingFace Transformers, due to a flaw in the Trainer class, that allows for arbitrary code execution CVE-2026-1839. HuggingFace Transformers is used in our speech runtimes. This vulnerabilitiy has been...

transformer-vae (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-66007 via datasets (1.1.3)

datasets PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - transformer-vae =0.0.1, =0.0.2 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

transformer-vae (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-66007 via datasets (1.1.3)

datasets PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - transformer-vae =0.0.1, =0.0.2 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...

Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards

We present a self-supervised acoustic eavesdropping attack that reconstructs typed text solely from keystroke sounds, without requiring labeled data for the target device. The proposed attack enables stealthy eavesdropping in two real-world scenarios-physical spaces public and semi-public and...

Adversarial Robustness of Phishing Email Detection: A Comparative Study of TF-IDF + Logistic Regression and Fine-Tuned DistilBERT

Phishing emails remain one of the most persistent cybersecurity threats, and machine-learning classifiers are widely used to detect them. Most reported detection accuracies, however, are measured on clean, in-distribution test data rather than on emails deliberately altered to evade detection. Th...

Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection

Machine learning-based intrusion detection systems IDSs often suffer from class imbalance and vulnerability to adversarial attacks, leading to degraded detection performance and reduced robustness. This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative...

PYSEC-2026-3062 SGLang has an Improper Input Validation/Injection Issue

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function gettokenizer of the file python/sglang/srt/utils/hftransformersutils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A hi...

SGLang has an Improper Input Validation/Injection Issue

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function gettokenizer of the file python/sglang/srt/utils/hftransformersutils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A hi...

vm2 Package Manager Code Execution

The vulnerability of the vm2 package manager’s code transformation transformer is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

EUVD-2026-42441

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

CVE-2026-55471

CVE-2026-55471 affects HAPI FHIR: org.hl7.fhir.utilities XsltUtilities.saxsonTransform overloads (XsltUtilities.saxonTransform) prior to 6.9.10. The root cause is the use of a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions, enabl...

CVE-2026-55471

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform... overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl without ACCESSEXTERNALDTD or ACCESSEXTERNALSTYLESHEET...

Multi-Class Vs. Multi-Label BERT for CVE-To-CWE Mapping: How Taxonomy Structure Shapes the Errors

Assigning Common Weakness Enumeration CWE categories to Common Vulnerabilities and Exposures CVE records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a \emphmulti-class formulation th...

ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification

Traditional malware detection methods struggle to generalize to obfuscated or previously unseen threats. This paper introduces ThreatVisionAI, a hybrid malware family classification framework that integrates a raw-image CNN, a wavelet-based CNN, and a Vision Transformer ViT to capture complementa...

XML External Entity (XXE) Injection

org.hl7.fhir.utilities is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the saxonTransform... methods instantiating an unprotected TransformerFactory without restricting external DTDs and stylesheets, which allows an attacker to supply a malicious XML document that...

Arbitrary Code Injection

Overview @tinacms/cli is a package used to set up your project with Tina Cloud configuration, and run a local version of the Tina Cloud content-api. Affected versions of this package are vulnerable to Arbitrary Code Injection through the addVariablesToCode/makeFieldsWithInternalCode process in...