30379 matches found
Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models
Beyond adapting Large Language Models LLMs to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same...
The Innocent Courier: Covert Exfiltration through Legitimate LLM Web Fetching
With the increasing capabilities of Large-Language-Models LLMs and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt...
Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks
Recent work has shown that large language models LLMs can be vulnerable to jailbreak attacks in which harmful intent is obscured through composition with benign tasks. A harmful request refused in isolation may elicit a different response when embedded within a larger, seemingly benign query. We...
PT-2026-105812
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PT-2026-105815
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
CLEANSTART-2024-AG66831 regex is an implementation of regular expressions for the Rust language
CVE-2022-24713 affects multiple packages. regex is an implementation of regular expressions for the Rust language. See references for individual vulnerability details...
Linux Distros Unpatched Vulnerability : CVE-2026-102830
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5....
Avesis 202608201331 Open Redirect
Avesis version 202608201331 and earlier contains an open redirect vulnerability in the /home/changeculture language-switch endpoint via the returnUrl parameter...
MediaWiki Wikibase Extension 1.46.0 Cross Site Scripting
MediaWiki Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10 contain a reflected cross site scripting vulnerability in Special:SetLabel language validation. The supplied proof of concept submits a harmless marker and detects unescaped reflection...
Faithful Dual-Constrained Erasure for Robust LLM Safety Alignment
Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models LLMs. However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicio...
Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
Recently, Vision-Language-Action VLA models have revolutionized robotic manipulation by seamlessly integrating visual perception, language understanding, and action generation in an end-to-end learning framework. However, since these models are designed to interact directly with the physical worl...
Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution
An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...
Do Defenses against LLM Extraction Work across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction
Large language models LLMs deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access...
CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
GHSA-QW65-CVWX-89V3 vulnerabilities
Vulnerabilities for packages: yaml-language-server, vitess, opensearch-dashboards, renovate, jupyter-base-notebook, unleash, wazuh-dashboard-fips, gitlab-rails-ce-fips, keep-fips, serve, nextcloud-server, prism, wazuh-dashboard, gitlab-rails-ce, unleash-proxy, keep...
GHSA-58MR-GQGX-XQ4G vulnerabilities
Vulnerabilities for packages: yaml-language-server, vitess, opensearch-dashboards, renovate, unleash, wazuh-dashboard-fips, gitlab-rails-ce-fips, keep-fips, serve, nextcloud-server, prism, wazuh-dashboard, gitlab-rails-ce, unleash-proxy, keep...
CVE-2026-84292 vulnerabilities
Vulnerabilities for packages: yaml-language-server, vitess, opensearch-dashboards, renovate, jupyter-base-notebook, unleash, wazuh-dashboard-fips, gitlab-rails-ce-fips, keep-fips, serve, nextcloud-server, prism, wazuh-dashboard, gitlab-rails-ce, unleash-proxy, keep...
CVE-2026-84394 vulnerabilities
Vulnerabilities for packages: yaml-language-server, vitess, opensearch-dashboards, renovate, unleash, wazuh-dashboard-fips, gitlab-rails-ce-fips, keep-fips, serve, nextcloud-server, prism, wazuh-dashboard, gitlab-rails-ce, unleash-proxy, keep...
