saffron

Saffron-1: Inference Scaling for LLM Safety Assurance 📖 Paper 🛠️ Dependencies The code was tested under the following dependencies: Python 3.12.3 CUDA 12.2 typingextensions==4.14.0 numpy==2.2.6 torch==2.5.1 huggingfacehub==0.30.2 accelerate==1.1.1 datasets==3.1.0 evaluate==0.4.3...

sonarqube

SonarQube Continuous Inspection...

PrivacyRaven

Note: This project is on hiatus. PrivacyRaven is a privacy testing library for deep learning systems. You can use it to determine the susceptibility of a model to different privacy attacks; evaluate privacy preserving machine learning techniques; develop novel privacy metrics and attacks; and...

Vulnerabilities found in Oracle Communications

Oracle has identified 31 vulnerabilities in various Oracle Communications products, including Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module – ASR, Oracle Communications Service Catalo...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Kubernetes Operator for Image Assurance It works as Admission Controller protecting unsafe images from being deployed Custom Controller watching ImageVulnerability CRD and scanning the image in the custom resource automatically Setup root@kitploit: $ kubectl apply -f...

HPESBNW05145 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Authentication Bypass, Denial of Service DoS, Unauthorized Data Injection, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.16 and below CVSS Scores: | CVE | CVSS Vector | Base Score | |...

crypto: caam - use print_hex_dump_devel to guard key hex dumps

...

HPESBNW05082 rev.1 - HPE Telco Automated Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity; Remote: Denial of Service DoS, Unauthorized Access to Data, Unauthorized Information Disclosure, Unqualified Configuration Change, local memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco...

HPESBNW05076 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Gain Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.15 and below - FAS and PDO CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-44249 |...

HPESBNW05080 rev.1 - HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass, Gain Unauthorized Access, Session Reuse, Input Validation; Remote: Authentication Bypass, Gain Unauthorized Access, Session Reuse, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC...

CGA-7F2G-WQ84-M729

Bulletin has no description...

Certification of Network Quantum Sensing

The distribution of quantum sensors on quantum networks is a key enabler of quantum technologies in interferometry, gravimetry, timekeeping, biological monitoring, and beyond. Yet, guaranteeing the security of these distributed sensors over noisy, insecure networks remains a formidable challenge...

From Frontier to Shadow AI: A Simmering Threat to Assurance and Security in Critical Infrastructure

Frontier AI systems, including large language models and emerging agentic AI tools, offer significant operational benefits but present unique challenges to critical infrastructure CI environments due to their non-deterministic and emergent properties. While formal adoption is inherently cautious...

On AI Security

Good report: Executive Summary: Let's say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don't actually work for measuring AI capabilities even when they are NOT emergent systemic properties like...

HPESBNW05056 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Directory Traversal, Server-Side Request Forgery SSRF, Stack Overflow; Remote: Denial of Service DoS, Unauthorized Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC UOC Version 3.1.20 and bel...

HPESBNW05045 rev.1 - Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.14 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-52999 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |...

iPhones and iPads Approved for NATO Classified Data

Apple announcement: …iPhone and iPad are the first and only consumer devices in compliance with the information assurance requirements of NATO nations. This enables iPhone and iPad to be used with classified information up to the NATO restricted level without requiring special software or...

Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...

EUVD-2026-11247

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...

CVE-2026-3429

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...