NewStart CGSL MAIN 7.02 : libxslt Multiple Vulnerabilities (NS-SA-2026-0092)

The remote NewStart CGSL host, running version MAIN 7.02, has libxslt packages installed that are affected by multiple vulnerabilities: - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is...

CVE-2026-78626: Incorrect Authorization

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

DEBIAN-CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CVE-2026-80837

CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's nf_tables subsystem, confirmed on version 7.2.0-rc6 via KASAN. The root cause is a race in nft_quota_obj_eval(), which enqueues a packet-path notification onto nft_net->notify_list via an unlocked list_add_tail(), while nft...

CVE-2026-85694

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

EUVD-2026-71143

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

Incorrect Remote IP Address Evaluation

Reactor Netty is vulnerable to an Incorrect Remote IP Address Evaluation. The vulnerability is due to improper evaluation of the remote IP address when the HAProxy Protocol is enabled, which may allow an attacker to spoof or manipulate the perceived client IP address under specific configurations...

PT-2026-85580

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract as object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165

n8n versions before 2.36.2 are affected by an expression sandbox bypass. The root cause is that free identifiers appearing in spread , computed-key , switch-case , or class-extension positions resolve against process globals rather than staying within the sandbox. Authenticated users with workflo...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

EUVD-2026-70400

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

SUSE CVE-2026-72350

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

Johnny Still Receives Spam SMS: Assessing the Robustness of SMS Spam Detection

SMS spam detection systems often achieve high accuracy in controlled environments but struggle against adversarial attacks and increasingly sophisticated spam tactics in real-world deployments. In this paper, we evaluate the robustness of SMS anti-spam systems that end users actually rely on,...

CVE-2026-82735: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

Using LLMs to Elicit Security Requirements for Service-Oriented Cyber Ranges

Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range SOR is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translate...