TrojanWorld: Backdooring World-Model Agents Via Imagination Steering

World models increasingly serve as the predictive core of model-based reinforcement learning agents, enabling them to simulate future dynamics and reason over imagined trajectories before acting. Their substantial training demands make pretrained world models attractive for distribution and reuse...

CVE-2026-86279: Session Fixation

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

CVE-2026-86277: Authorization Bypass Through User-Controlled Key

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file deleteexam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The...

Fine-Grained Distributed Backdoor Attacks in Federated Learning

Federated learning, as a privacy-preserving distributed machine learning paradigm, faces significant threats from backdoor attacks. Compared to centralized attacks, distributed backdoor attacks are more harmful but require more poisoned samples to compensate for the loss of trigger strength due t...

CVE-2026-86275: Improper Privilege Management

A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. Remote exploitation of the...

PT-2026-86647

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public...

CVE-2026-86280: Cleartext Storage of Sensitive Information

A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cictportal.sql. Such manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack remotely. The...

BUUCTF-Web-Writeups

BUUCTF-Web-Writeups A collection of CTF Web challenges writ...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by net/url (Publicly disclosed vulnerability) ( CVE-2025-47912)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2025-47912 Vulnerability Details CVEID:CVE-2025-47912 DESCRIPTION: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by transformers(Publicly disclosed vulnerability) ( CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568 Vulnerability Details CVEID:CVE-2024-11393 DESCRIPTION: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code...

PT-2026-85716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the VXLAN implementation where a filtered bulk flush of the Forwarding Database FDB can lead to an invalid pointer. This occurs when the vxlan fdb dst destroy function...

Federated Attack Campaign Detection Via Contrastive Encoding of Threat Indicators in Gradient Updates

Detecting orchestrated cyberattack campaigns that span multiple organizations traditionally requires sharing sensitive telemetry and threat intelligence across institutional boundaries and country borders, a barrier that Federated Learning removes by training shared threat detectors directly on...

BIT-ELASTICSEARCH-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

Data-Optimized Contingency Screening: A Machine Learning Approach to Power System Security

Ensuring the security of the power system is essential for stability and reliability, especially in the event of disruption. Effective classification of contingency in power systems enables proactive decision-making and mitigates large-scale breakdowns and failures. This study explores the use of...

CVE-2026-82293

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-78598

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

EUVD-2026-70067

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82293

Kibana's machine learning feature is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user to invoke machine learning functionality beyond their authorization scope, leading to unauthorized cluster resource consumption with low availability impact. The vulnerabil...