30493 matches found
CLEANSTART-2026-QE04836 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...
Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...
The Innocent Courier: Covert Exfiltration through Legitimate LLM Web Fetching
With the increasing capabilities of Large-Language-Models LLMs and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt...
Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks
Recent work has shown that large language models LLMs can be vulnerable to jailbreak attacks in which harmful intent is obscured through composition with benign tasks. A harmful request refused in isolation may elicit a different response when embedded within a larger, seemingly benign query. We...
PT-2026-105815
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PT-2026-105812
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models
Beyond adapting Large Language Models LLMs to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same...
CLEANSTART-2024-AG66831 regex is an implementation of regular expressions for the Rust language
CVE-2022-24713 affects multiple packages. regex is an implementation of regular expressions for the Rust language. See references for individual vulnerability details...
CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
Linux Distros Unpatched Vulnerability : CVE-2026-102830
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5....
Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
Recently, Vision-Language-Action VLA models have revolutionized robotic manipulation by seamlessly integrating visual perception, language understanding, and action generation in an end-to-end learning framework. However, since these models are designed to interact directly with the physical worl...
Avesis 202608201331 Open Redirect
Avesis version 202608201331 and earlier contains an open redirect vulnerability in the /home/changeculture language-switch endpoint via the returnUrl parameter...
Faithful Dual-Constrained Erasure for Robust LLM Safety Alignment
Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models LLMs. However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicio...
MediaWiki Wikibase Extension 1.46.0 Cross Site Scripting
MediaWiki Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10 contain a reflected cross site scripting vulnerability in Special:SetLabel language validation. The supplied proof of concept submits a harmless marker and detects unescaped reflection...
Do Defenses against LLM Extraction Work across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction
Large language models LLMs deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access...
Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution
An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...
CVE-2026-84394 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, prism, keep-fips, renovate, unleash, keep, commercial-gitlab-rails-ee-fips, serve, gitlab-rails-ce, wazuh-dashboard-fips, nextcloud-server, yaml-language-server, gitlab-rails-ce-fips, opensearch-dashboards, commercial-gitlab-rails-ee, vitess,...
GHSA-QW65-CVWX-89V3 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, jupyter-base-notebook, keep-fips, prism, renovate, unleash, keep, commercial-gitlab-rails-ee-fips, serve, gitlab-rails-ce, wazuh-dashboard-fips, nextcloud-server, yaml-language-server, gitlab-rails-ce-fips, opensearch-dashboards,...
CVE-2026-84292 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, jupyter-base-notebook, keep-fips, prism, renovate, unleash, keep, commercial-gitlab-rails-ee-fips, serve, gitlab-rails-ce, wazuh-dashboard-fips, nextcloud-server, yaml-language-server, gitlab-rails-ce-fips, opensearch-dashboards,...
GHSA-58MR-GQGX-XQ4G vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, prism, keep-fips, renovate, unleash, keep, commercial-gitlab-rails-ee-fips, serve, gitlab-rails-ce, wazuh-dashboard-fips, nextcloud-server, yaml-language-server, gitlab-rails-ce-fips, opensearch-dashboards, commercial-gitlab-rails-ee, vitess,...
