CVE-2026-109428 Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-109428

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-109428

Mistral Vibe versions before 2.25.5 are vulnerable to a permission validation bypass due to a parsing discrepancy between tree-sitter-bash and bash . The flaw exists in the _extract_commands() function of bash.py, where the system incorrectly handles backslash-newline line continuations . An atta...

SUSE CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-90260

A flaw was found in the Linux kernel's Btrfs zoned filesystem. When a freed-but-still-dirty tree block is written out as zeros, the btreecsumonebio function improperly clears the extent buffer's in-memory content. This can lead to corruption of the extent tree, potentially causing system...

CVE-2026-90110

A flaw was found in the Linux kernel's inetpeer rate limiting system. An off-path attacker could exploit a deterministic Red-Black tree traversal mechanism to predict the tree's structure and force the eviction of specific network peer entries. This manipulation allows the attacker to reset...

PT-2026-111824

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...

PT-2026-111823

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extract commands function of bash.p...

CVE-2026-109429: Interpretation Conflict

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

Jev-Guard: Fast Routing and Auditing Agent Actions over Editable Policy Trees

Agent harnesses require a low-latency guardrail model together with customizable audit policies. However, deploying an auto-regressive guardrail model remains challenging: such models incur high inference latency and are often poorly aligned with customized policies. To address these problems, we...

Empirical Evaluation of Machine Learning for Cloud Cryptojacking Detection: Effects of Preprocessing and Evaluation Protocols

Artificial intelligence AI has been widely applied to cloud cryptojacking detection. Classical machine learning models remain among the most widely used approaches for cloud cryptojacking detection. This paper presents an empirical evaluation of six widely used classical machine learning models f...

CVE-2026-81495

Summary "POST /1.0/storage-pools//volumes" with an "application/octet-stream" body custom-volume ISO or backup import uses an attacker-controlled name as an on-disk path segment without validation. A project user with the "cancreatestoragevolumes" entitlement can supply "X-Incus-name: ../../../.....

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

EUVD-2026-97653

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

PT-2026-110430

Name of the Vulnerable Software and Affected Versions ngx cache purge versions prior to 3.0.4 Description An issue exists where file deletion is possible via a symlink attack when nginx and a served application, such as WordPress, operate under the same user account. This occurs because the ngx...

TRAP: Tree-Guided Reinforcement-Augmented Probing for Automated LLM Jailbreaking

Aligned large language models LLMs remain vulnerable to jailbreak prompts that circumvent their safety guardrails, making the identification of these vulnerabilities important for understanding and mitigating model weaknesses. Existing automated jailbreak methods explore prompt candidates or reus...

CVE-2026-98244

A flaw was found in the Linux kernel's Btrfs file system. When an error occurs while rebuilding the free space tree, the kernel fails to properly reset an internal state flag on failure paths. A local user could exploit this condition during filesystem operations, leaving the flag set on an activ...