mininode

Mininode Mininode is a CLI tool to reduce the attack surface of the Node.js applications by using static analysis of source code. It supports two modes of reduction 1 coarse, 2 fine. Mininode constructs the dependency graph modules and functions used of the application starting from main file, i....

better_opts_attacks

May I have your attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks This repository contains code to run the ASTRA and ASTRA++ attacks that break SecAlign++, SecAlign, StruQ. This repository also contains some examples of generated attacks and attack...

DeeCLIP

DeeCLIP: A Robust and Generalizable Transformer-Based Framework for Detecting AI-Generated Images ☀️ If you find this work useful for your research, please kindly star our repo and cite our paper! ☀️ TODO We are working hard on the following items: Release ArXiv paper Release training scripts...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

refusal-relocates

Quick start · Usage · CLI · Results · Reproduce · FAQ · Citation News 2026-09-28 Code released, with the run records and scripts that rebuild the paper's tables. Overview A few dozen harmful examples can remove an aligned model's refusal of harmful requests. Prior work localizes safety to specifi...

Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models

Beyond adapting Large Language Models LLMs to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same...

Backdoor Purification for LoRA-Tuned LLMs Via Null-Space Projection

With the rapid adoption of large language models LLMs and parameter-efficient fine-tuning PEFT methods, the risk of backdoor attacks has become more severe. Existing backdoor purification methods typically rely on at least one of the strong assumptions, such as prior knowledge of triggers, access...

RAISE: Reinforcing Access Control Policy Synthesis in LLMs Via Symbolic Evaluation

Translating natural-language access-control requirements into policies requires careful reasoning about permissions, constraints, and exceptions, and even frontier LLMs often produce policies that violate the intended authorization semantics. We construct CedarInstruct, to our knowledge the first...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak allows for privilege escalation . The vulnerability exists because the system fails to inspect the contents of composite roles when verifying if a delegated administrator has permission to assign a specific role. Consequen...

CVE-2026-96448: Improper Authorization

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

PT-2026-97704

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system does not verify specific password reset authorizations...

CVE-2026-28658

In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

BIT-KEYCLOAK-2026-9099 Keycloak: group-admin escalation to realm-admin

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 FGAPv2 is enabled, an attacker wi...

SUSE CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the gh auth status process. An attacker can obtain partial authentication token values by accessing terminal or CI output where the process was executed. This is only exploitable if ...

AZL-95468 CVE-2026-64652 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...