Backdooring Sparse Autoencoders

Sparse autoencoders SAEs are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass...

CVE-2026-105444: Improper Control of Resource Identifiers

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

PT-2026-104718

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE PAYMENT INSTALLED leads to code injection. The attack can be executed remotely...

PT-2026-104716

A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

PT-2026-105999

A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has be...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

ROS-20261005-73-0026

The vulnerability of the Rsync file transfer and synchronization utility relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...

PT-2026-104723

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...

PT-2026-106192

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

PT-2026-104695

Name of the Vulnerable Software and Affected Versions aidl affected versions not specified Description A missing permission check in aidl allows for a local escalation of privilege. This issue can be exploited by a malicious actor who has already obtained System privilege, and it requires no user...

Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security

LLM-based multi-agent systems MAS engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-20588: Out-of-bounds Write

In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607...

CVE-2026-78862

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...

PT-2026-106173

Name of the Vulnerable Software and Affected Versions sssd affected versions not specified Description A flaw allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

PT-2026-106203

Name of the Vulnerable Software and Affected Versions feelec-yishu feelcrm-os version 1.0.0 Description An issue in the UploadTicketFile endpoint within the file App/Feelcrm/Crm/Controller/UploadController.class.php allows for unrestricted file upload. This occurs when the cmd argument is...

CVE-2026-105468: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

PT-2026-104736

Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22 Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument...