Towards Safe World Models: Risks, Defenses, and Evaluation

World models support planning, control, learning from imagined experience, and model-mediated evaluation by predicting action-conditioned consequences. Their safety cannot be inferred from predictive accuracy alone: errors in observations, state and memory, dynamics, evaluation, execution, or...

ROS-20261009-73-0541

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0479

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0458

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261009-73-0379

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0314

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0246

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0221

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0043

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-108877

Name of the Vulnerable Software and Affected Versions Restrict User Access – Membership Plugin with Force versions prior to 2.8.2 Description A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to versi...

Apache Tomcat Access Control Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

PT-2026-117995

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

CVE-2026-107419: Missing Authorization

Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2...

CVE-2026-96461: Missing Authorization

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-95589: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n...

CVE-2026-19574: Improper Access Control

The ARM64 MMU back-end allocated address space identifiers ASIDs for memory domains with a bare round-robin counter in archmemdomaininit arch/arm64/core/mmu.c. VMASIDBITS is 8, so only 255 ASIDs exist; once the counter wrapped, archmemdomaininit could hand an ASID to a new domain while a still-li...

CVE-2026-92989: Improper Access Control

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...

Cisco Application Policy Infrastructure Controller Access Control Compromise

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Cisco Application Policy Infrastructure Controller Resource Management Data Compromise

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to insufficient control over resources during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of t...

driver/net/ethernet/intel/ice/ice_main.c component of the DoS

The vulnerability in the drivers/net/ethernet/intel/ice/icemain.c component of the Linux operating system is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...