PT-2026-106728

Name of the Vulnerable Software and Affected Versions Kusalkasilva Learning-Management-System versions up to ffeb873f8803f1e9664384ff75000c7da45466d2 Description A remote SQL injection exists within the Student Registration Endpoint component, specifically affecting an unknown function in the...

CVE-2026-105921: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

GCTAuto-Encoder: A Cross Modal Framework for Security Flaw Detection in IoT Networks

IoT encompasses diverse physical entities, from smart home devices to autonomous vehicles, creating a complex environment with heterogeneous security models. This heterogeneity makes IoT sub-systems vulnerable to various network attacks. Modern security systems must therefore be more robust to...

PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron

Detecting microarchitectural attacks is critical given their proliferation in recent years. Many of these attacks exhibit intrinsic behaviors essential to the nature of their operation, such as creating contention or misspeculation. This study systematically investigates the microarchitectural...

Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training

Developers can build LLM agents by adapting third-party models through benign post-training. We study a supply-chain threat in which an attacker supplies a model with a backdoor: hidden behavior that produces malicious outputs when a particular input pattern appears. Focusing on...

NetAgent: Multi-Task Agentic Network Traffic Analysis Made Practical

Network traffic analysis is central to network security, spanning tasks from intrusion detection to encrypted traffic classification. Existing approaches either train task-specific models that generalize poorly or rely on costly traffic foundation models that still struggle under distribution...

CVE-2026-85209 IDOR in AVEZ Electronics's LMS

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

CVE-2026-85209 IDOR in AVEZ Electronics's LMS

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

CVE-2026-85209

The Learning Management System (LMS) developed by AVEZ Electronics Communication Training and Consultancy Trade Inc. is impacted by a Missing Authorization vulnerability (CWE-862). The root cause is incorrectly configured access control security levels , which allows for exploitation. The vulnera...

EUVD-2026-91567

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

PT-2026-104302

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails

AI services increasingly rely on black-box security guardrails, yet privacy-preserving model auditing regimes often cannot measure how well these systems perform in both a human eyes-off production setting, which disallows human inspection of user input, and a machine eyes-off setting, which...

Losing gamblers pushed to bet more by DraftKings’ AI, report says

Two separate investigations have raised concerns about betting site DraftKings’ marketing to target problem gamblers, including its use of AI. On September 19, the New York Times reported that the company’s machine learning model targeted people who were more likely to respond to betting promotio...

A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders

Ransomware has emerged as a major cybersecurity threat, with incidents increasing in frequency and impact across critical sectors. These attacks are typically launched through phishing emails, malicious downloads, or exploitation of software vulnerabilities to gain system access. Once inside, the...

A Resource-Aware Behavior Reconstruction and Hierarchical Semantic Learning Framework for Host Intrusion Detection

System calls syscalls record key interactions between running programs and the operating system kernel, providing fine-grained and minimally intrusive data for host-based intrusion detection systems HIDS deployed in cloud and other modern computing environments. However, existing methods often...

Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Quantum key distribution QKD links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel's own noise gains by following that drift has not been quantified...

Homomorphic Advantage Operator: Stabilizing Reinforcement Learning under Fully Homomorphic Encryption Constraints

Privacy-preserving machine learning presents significant deployment challenges on the cloud for intelligent systems with confidential data. Fully Homomorphic Encryption FHE offers a compelling solution for secure computation, preserving data confidentiality of cloud computations. However, applyin...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

Compression Footprints As Security Signals for Model-Poisoning Defense in Federated Learning

Lossy compression is widely used in Federated Learning FL but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior...

Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution

An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...