IF-Guide

IF-Guide: 영향 함수 기반 LLM 탈독화 NeurIPS 2025 이 저장소는 우리 논문에서 소개한 LLM 탈독화 기법인 IF-Guide의 코드를 포함합니다: IF-Guide: 영향 함수 기반 LLM 탈독화 Zachary Coalson , Juhan Bae, Nicholas Carlini, Sanghyun Hong TL;DR 우리의 방법을 사용하면 유해한 학습 예제를 식별하고 사전 학습 또는 미세 조정 중에 이를 억제하여 LLM을 탈독화할 수 있습니다! 초록 우리는 학습 데이터가 대규모 언어 모델에서 유해한 행동의 출현에...

UBUNTU-CVE-2026-89554

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and msk from the saved cookie entry when rebuilding the request socket for ...

CVE-2026-89554

CVE-2026-89554 affects the Linux kernel's MPTCP (Multipath TCP) implementation. When reconstructing a MP_JOIN request under SYN cookies, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and ...

GitLab 19.1 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-15387)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel versions 2.6.39 through 5.10.16, as used in Xen. The block, net, and SCSI backends consider certain errors as ordinary bugs, which are deliberately designed to cause kernel crashes. For errors that may be influenced by guests such as memory exhaustion...

Astra Linux – Vulnerability in PostgresSQL 11

A vulnerability was discovered in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the...

Social media platforms crack down on drone factory recruiting game

A video game about drone warfare may look like an unusual cybersecurity story. But cybersecurity isn't only about malware or stolen passwords. Sometimes it's about understanding how online platforms are used to influence decisions, build trust, and persuade people to share personal information or...

CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

PYSEC-2026-3532 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...

EUVD-2026-45256

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

PYSEC-2026-2007 vantage6 collaboration admins can extend their influence by expanding the collaboration

Impact Collaboration administrators can add extra organizations to their collaboration. When doing that, they extend their influence: for instance, for organizations that they include, they can then create new users for which they know the passwords, and use that to read task results of other...

GO-2026-5741 free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5470 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5396 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5093 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef...

CVE-2026-48721

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the executesqlquery function. An attacker can execute arbitrary SQL statements and potentially achieve remote code execution by injecting a multi-statement payload through prompt injectio...

CVE-2026-40247

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for reading Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when...

CVE-2026-44326

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, patch, and delete traffic-influence subscriptio...