44866 matches found
CLSA-2026-1786623881 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 9 CVEs. Fixed in 6.0.16-tuxcare.5...
CVE-Web-Framework
Web Framework CVE Vulnerability Reproduction Testbed Warn...
Dissecting the JWR phishing framework
Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...
CLSA-2026-1786609421 TuxCare security update for org.grails (17 CVEs)
TuxCare rebuilt 33 org.grails packages to address 17 CVEs. Fixed in 6.2.1-tuxcare.1...
CLSA-2026-1786606429 TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 5 CVEs. Fixed in 5.3.31-tuxcare.10...
Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench
Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.1 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...
WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...
CLSA-2026-1786599882 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.15-tuxcare.3...
CLSA-2026-1786598361 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 3 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.6...
PT-2026-71723
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
ATOBench: Tracing How Autonomous Penetration-Testing Agents Verify Vulnerabilities When Target Evidence Lies
Autonomous penetration-testing agents rely on target responses. These responses guide both subsequent actions and the final report. A deceptive response can therefore redirect both the attack trajectory and the agent's verification process. However, final reports reveal little about how an agent...
CVE-2026-73647: Improperly Controlled Modification of Object Prototype Attributes
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
Security evaluations of tool-using agents often equate stored labels with behavioral facts. We audit a preserved campaign by tracing 10,200 execution rows to 180 model-bound requests, 45 semantic requests, and 15 observable stimuli. Two schema treatments were delivered, but the planned external...
Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents
The expanding operational capabilities of large language model LLM agents introduce sophisticated security threats. Runtime defenses have emerged as an effective approach to mitigating these risks by integrating security mechanisms into the agent execution loop. However, existing runtime defenses...
CLSA-2026-1786555755 TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 26 org.springframework packages to address 10 CVEs. Fixed in 6.1.7-tuxcare.2...
CLSA-2026-1786552823 TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5...
CVE-2026-73229
A flaw was found in Django REST framework. The AdminRenderer component, when processing an invalid write request, can improperly invoke a GET request without adequate permission checks. This oversight allows an unauthenticated attacker to access data that they are not authorized to view, leading ...
CVE-2026-73228
A flaw was found in Django REST framework. A remote attacker could exploit a vulnerability in the request.data parsing mechanism, which bypasses Django's DATAUPLOADMAXMEMORYSIZE protection. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive...