CVE-2026-110449: Integer Overflow or Wraparound

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled...

Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity

We study a protocol-level reaction leakage in CKKS deployments where public coefficient-to-slot C2S evaluation keys are combined with a client's 1-bit validity response. Under this deployment surface, a malicious evaluator can recover a ternary secret key using asymptotically optimal $OH$ reactio...

Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers

TypeSafe AI's Jev is a new kind of safety judge. It generates no text and no label: it answers questions the developer defines in advance and returns a probability for each answer. The vendor admits that adversarial input can change these answers but gives no numbers. In this paper, we present th...

CompanionSafe: From Multi-Turn Safety Evaluation to Guardrails for AI Companions

AI companions provide users with emotional support and ongoing companionship, but their sustained relational interactions also introduce distinct safety risks. Prior work largely targets general harms or specific companion platforms and risk categories, while relying on manually collected...

CVE-2026-9191

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

CVE-2026-85955 Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

EUVD-2026-97517

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

CVE-2026-9191: Origin Validation Error

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

promptfoo

Promptfoo: evaluaciones de LLM y red teaming promptfoo es una CLI y biblioteca para evaluar y hacer red teaming de aplicaciones basadas en LLM. Deja de usar prueba y error... empieza a desplegar agentes seguros y confiables Sitio web · Primeros pasos · Red Teaming · Documentación · Discord...

fuzzbench

FuzzBench: Evaluación Comparativa de Fuzzers como Servicio FuzzBench es un servicio gratuito que evalúa fuzzers en una amplia variedad de referencias del mundo real, a escala de Google. El objetivo de FuzzBench es facilitar la evaluación rigurosa de la investigación en fuzzing y hacer que dicha...

gotestwaf

GoTestWAF GoTestWAF es una herramienta para la simulación de ataques a API y OWASP que soporta una amplia variedad de protocolos de API, incluyendo REST, GraphQL, gRPC, SOAP, XMLRPC, y otros. Fue diseñada para evaluar soluciones de seguridad de aplicaciones web, como proxies de seguridad de API,...

should-i-trust

should-i-trust Resumen should-i-trust es una herramienta para evaluar señales OSINT de un dominio. Requisitos should-i-trust requiere claves API de las siguientes fuentes: Censys.io - Gratis para las primeras 250 consultas al mes VirusTotal - Gratuito GrayHatWarFare - Gratuito con resultados...

sniffles

Sniffles--Generador de Capturas de Paquetes para IDS y Evaluación de Expresiones Regulares Sniffles es una herramienta para crear capturas de paquetes que probarán IDS que usan patrones fijos o expresiones regulares para detectar comportamientos sospechosos. Sniffles funciona de manera muy simple...

ossem-power-up

OSSEM Una herramienta para evaluar la calidad de los datos, construida sobre el increíble proyecto OSSEM. Misión Responder a la pregunta: Quiero empezar a cazar técnicas ATT&CK, ¿qué fuentes de registro y eventos son más adecuados? Crear transparencia sobre las fortalezas y debilidades de tus...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome DevTools. Recursos...

EUVD-2026-96609

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large...

cspparse

cspparse Descrizione cspparse è uno strumento per valutare le Content Security Policies. Utilizza l'API di Google per recuperare gli header CSP e li restituisce in formato ReconJSON. Non solo controlla gli header tramite l'API di Google, ma analizza anche l'HTML del sito target per cercare...

sandy

sandy Copyright 2013 Sandy Scritto da: Laszlo Toth, Ferenc Spala Descrizione Sandy è un framework open-source per la valutazione della crittografia dei telefoni Samsung. Sandy dispone di diversi moduli che consentono di eseguire diversi scenari di attacco contro telefoni Samsung crittografati. Pe...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

Towards Safe World Models: Risks, Defenses, and Evaluation

World models support planning, control, learning from imagined experience, and model-mediated evaluation by predicting action-conditioned consequences. Their safety cannot be inferred from predictive accuracy alone: errors in observations, state and memory, dynamics, evaluation, execution, or...