ai4rag (>=0.9.0, <=0.10.4), distlk (0.1.0rc1) +3 more potentially affected by CVE-2026-105751 via docling (>=2.107.0, <=2.118.1)

docling PYPI version =2.107.0, =0.9.0, =0.3.0, =0.3.0, =0.3.2 Source cves: CVE-2026-105751 Source advisory: OSV:PYSEC-2026-4207...

ai4rag (>=0.9.0, <=0.10.4), distlk (0.1.0rc1) +3 more potentially affected by CVE-2026-105751 via docling (>=2.107.0, <=2.118.1)

docling PYPI version =2.107.0, =0.9.0, =0.3.0, =0.3.0, =0.3.2 Source cves: CVE-2026-105751 Source advisory: SNYK:PYTHON-DOCLING-20537234...

Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-Based Vulnerability Reasoning

Large Language Models LLMs are increasingly deployed for automated software vulnerability analysis. Binary classification alone is insufficient; practitioners need explanations to triage bugs and engineer patches. Standard practice relies on Chain-of-Thought CoT prompting, but free-form reasoning...

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

MAI-2025-0018

The VERA framework employs variational inference to generate diverse and fluent adversarial prompts capable of circumventing the safety mechanisms embedded within large language models LLMs. By training an attacker model through a variational objective, VERA learns a distribution of prompts that...

CVE-2026-26334 Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials

Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll Veramark.Core.Config class. These keys are used to encrypt the password of the service account stored in C:\VeraSMART Data\app.settings. An attacker with local access to the...

CVE-2019-20483

An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application...

CVE-2019-20484

An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in...

MAL-2025-137749 Malicious code in vera-toge58-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 041ab0929c60cba0553cbb61ce954429bbf93a7ec49ce5d5ed3f0dd803b9756f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-bakso46-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20f0a14ed5f441a35dc15f4d79f478d0a434914b696c607c2aaa01f71555ec0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-donat49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d2d5cc1706a731f9dcf35d6bd0cbce97210406416dc23a902841ded221acbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-gaplek47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b462e5ae36e628740bab7801755f1181b79595ca85dca8709ea8b2f688a6b31e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-jamblang72-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddaac23346fc7fa5b18b23864fb0eb31d85ea24a7769296e16abdb3a5051881 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-kepok31-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b11359caf173a5874ceca310a5d680f9c47601f83778d8a47efcee0cc046ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-kripik87-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a3312cf16510ebfe179e02bd95d9d7703e411f94f3f6ebc30aa5a478c01b836 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-miebogor61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e12e1138993f80d9bde1672db663aaf68acd04fefc9585db6784db29bd7d665c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-soto36-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd45c3aa56665ced560cb74a35cca9b9a9468bddbb928019a284365048b1ee46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-takokak29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e2320e44b341df0fb64145af30d02f4852aa990aae86e27a4b76e337f29a78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vera-telurtahu22-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949f0f9dc969a0c7f6e33a06944f2844d1e20bfe30c28e1f408e89f489792033 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137748 Malicious code in vera-tempe15-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c6a2d293ac06f4f4c2207c8454570c89c073e9c97ee6e42927e8810255f85f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...