SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

Language-model agents increasingly use tools to act on external systems. Earlier actions can alter files, permissions, database records, or other state, making a later routine-looking action harmful. Yet the visible interaction may not reveal the underlying state needed to assess that action. We...

API Secrets Should Never Become Tokens in the LLM's Vocabulary

Tool-using large language model LLM agents turn credential hygiene from a storage problem into an execution-security problem. A key pasted into a prompt, or embedded in a system prompt or tool configuration, crosses from an authentication boundary into a data pipeline, where it may persist in...

No Free Efficiency: Revisiting the Trade-Off between Training Efficiency and Model Vulnerability

Training efficiency has become the central driver of recent progress in foundation models. To overcome the massive computational and data requirements of large-scale training, researchers increasingly adopt strategies such as selective data sampling, efficient pre-training, and simplified...

sentinel

Sentinel · Security Operations & Management Console Lightwe...

CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

PT-2026-99374

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 through 1.19.0 Description The software registers the globalcontext.Lib Common Expression Language CEL library in its policy environment without restricting it to the policy's namespace. This differs from other librarie...

CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-85750

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

EUVD-2026-87094

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CLEANSTART-2026-FD89775 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CVE-2026-85750: Improper Input Validation

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

Go Symbolic Reference Privilege Escalation

The vulnerability of the Go programming language is related to the tracking of symbolic references. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-98860

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description Insufficient validation and unsafe processing of user-supplied image files when using the Imagick library allow for arbitrary file read and remote code execution. Attackers can use format confusion,...

Towards Understanding LLM-Based Log Anomaly Detection: An Empirical Study of Performance, Efficiency, and Robustness

Large language models LLMs have demonstrated promising performance in log anomaly detection, yet how their adaptation strategies, architectures, and deployment configurations affect detection effectiveness remains insufficiently understood. To investigate these factors, we conduct a systematic...

GHSA-6V3R-4P5C-MRP5 Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...