TeleAI-Safety: A Comprehensive LLM Jailbreaking Benchmark Towards Attacks, Defenses, and Evaluations

While the deployment of large language models LLMs in high-value industries continues to expand, the systematic assessment of their safety against jailbreak and prompt-based attacks remains insufficient. Existing safety evaluation benchmarks and frameworks are often limited by an imbalanced...

Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

Hybrid Quantum-Classical Autoencoders for Unsupervised Network Intrusion Detection

Unsupervised anomaly-based intrusion detection requires models that can generalize to attack patterns not observed during training. This work presents the first large-scale evaluation of hybrid quantum-classical HQC autoencoders for this task. We construct a unified experimental framework that...

Safe2Harm: Semantic Isomorphism Attacks for Jailbreaking Large Language Models

Large Language Models LLMs have demonstrated exceptional performance across various tasks, but their security vulnerabilities can be exploited by attackers to generate harmful content, causing adverse impacts across various societal domains. Most existing jailbreak methods revolve around Prompt...

A Novel Trust-Based DDoS Cyberattack Detection Model for Smart Business Environments

As the frequency and complexity of Distributed Denial-of-Service DDoS attacks continue to increase, the level of threats posed to Smart Internet of Things SIoT business environments have also increased. These environments generally have several interconnected SIoT systems and devices that are...

Arbitrary Code Injection

Overview ultralytics is an Ultralytics YOLOv8 for SOTA object detection, multi-object tracking, instance segmentation, pose estimation and image classification. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe use of eval on attacker-controllable strings. Th...

Learning the Wrong Lessons: Syntactic-Domain Spurious Correlations in Language Models

Whitepaper from researchers at MIT, Northeastern University, and Meta. For an LLM to correctly respond to an instruction it must understand both the semantics and the domain i.e., subject area of a given task-instruction pair. However, syntax can also convey implicit information Recent work shows...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the policy evaluation process when egress.toGroups.aws.securityGroupsIds references AWS security group IDs that do not exist or are not attached to any network interface. An attacker can gain broader outbound...

COGNITION: From Evaluation to Defense against Multimodal LLM CAPTCHA Solvers

This paper studies how multimodal large language models MLLMs undermine the security guarantees of visual CAPTCHA. We identify the attack surface where an adversary can cheaply automate CAPTCHA solving using off-the-shelf models. We evaluate 7 leading commercial and open-source MLLMs across 18...

Securing Large Language Models (LLMs) from Prompt Injection Attacks

Large Language Models LLMs are increasingly being deployed in real-world applications, but their flexibility exposes them to prompt injection attacks. These attacks leverage the model's instruction-following ability to make it perform malicious tasks. Recent work has proposed JATMO, a task-specif...

akademy-classe (>=1.1.0 <=7.0.0), akademy-classe-evaluation (>=1.3.0 <=7.0.0) +5 more potentially affected by CVE-2025-66424 via trytond (=7.0.0)

trytond PYPI version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66424 Source advisory:...

akademy-classe (>=1.1.0 <=7.0.0), akademy-classe-evaluation (>=1.3.0 <=7.0.0) +5 more potentially affected by CVE-2025-66423 via trytond (=7.0.0)

trytond PYPI version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66423 Source advisory:...

akademy-classe (>=1.1.0 <=7.0.0), akademy-classe-evaluation (>=1.3.0 <=7.0.0) +5 more potentially affected by CVE-2025-66424 via trytond (=7.0.0)

trytond PYPI version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66424 Source advisory: OSV:GHSA-2W93-QWPP-VGV...

akademy-classe (>=1.1.0 <=7.0.0), akademy-classe-evaluation (>=1.3.0 <=7.0.0) +5 more potentially affected by CVE-2025-66422 via trytond (=7.0.0)

trytond PYPI version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66422 Source advisory: OSV:GHSA-JQFC-9Q34-PRH...

akademy-classe (>=1.1.0 <=7.0.0), akademy-classe-evaluation (>=1.3.0 <=7.0.0) +5 more potentially affected by CVE-2025-66423 via trytond (=7.0.0)

trytond PYPI version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66423 Source advisory: OSV:GHSA-P3P5-XRMV-4J6...

Large Language Models Cannot Reliably Detect Vulnerabilities in JavaScript: The First Systematic Benchmark and Evaluation

Researchers have proposed numerous methods to detect vulnerabilities in JavaScript, especially those assisted by Large Language Models LLMs. However, the actual capability of LLMs in JavaScript vulnerability detection remains questionable, necessitating systematic evaluation and comprehensive...

Red Teaming Large Reasoning Models

Large Reasoning Models LRMs have emerged as a powerful advancement in multi-step reasoning tasks, offering enhanced transparency and logical consistency through explicit chains of thought CoT. However, these models introduce novel safety and reliability risks, such as CoT-hijacking and...

Prompt Injection Through Poetry

In a new paper, "Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models," researchers found that turning LLM prompts into poetry resulted in jailbreaking the models: Abstract : We present evidence that adversarial poetry functions as a universal single-turn...

Remote Code Execution (RCE)

Happy DOM is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of a non-isolated Node.js VM context with JavaScript evaluation enabled by default, which allows an attacker to run untrusted code that can escape the sandbox—potentially gaining access to process-level...

PT-2025-48264

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0 through 4.20.1 Apache CloudStack versions 4.21.0 through 4.21.9 Description An improper control of code generation 'Code Injection' issue exists in Apache CloudStack, specifically within several APIs accessibl...