Gitea parseKeyString SSH Key Parse

The vulnerability of the parseKeyString function in the models/asymkey/sshkeyparse.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause service failures...

cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-15307 via django (2.0.0)

django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...

contextualized-topic-models (>=2.0.0, <=2.1.1) potentially affected by CVE-2026-68770 via sentence-transformers (1.1.1)

sentence-transformers PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =2.0.0, =2.1.1 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

contextualized-topic-models (>=1.8.0, <=1.8.2) potentially affected by CVE-2026-68770 via sentence-transformers (0.4.1)

sentence-transformers PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.8.0, =1.8.2 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

contextualized-topic-models (>=1.5.2, <=1.7.1) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.6)

sentence-transformers PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.5.2, =1.7.1 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

contextualized-topic-models (1.4.2) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.2)

sentence-transformers PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models 1.4.2 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

contextualized-topic-models (>=1.4.3, <=1.5.0) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.5.1)

sentence-transformers PYPI version 0.3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.4.3, =1.5.0 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

PYSEC-2026-4132 Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method Then when the victim...

PYSEC-2026-4131 Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

Summary Picklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method -...

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

SummaryPicklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files. DetailsThe attack payload executes in the following steps:- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method- Then,...

Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks

Recent work has shown that large language models LLMs can be vulnerable to jailbreak attacks in which harmful intent is obscured through composition with benign tasks. A harmful request refused in isolation may elicit a different response when embedded within a larger, seemingly benign query. We...

PT-2026-105881

Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method Then when the victim...

The Innocent Courier: Covert Exfiltration through Legitimate LLM Web Fetching

With the increasing capabilities of Large-Language-Models LLMs and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt...

Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models

Beyond adapting Large Language Models LLMs to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same...

Do Defenses against LLM Extraction Work across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction

Large language models LLMs deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access...

Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution

An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...

Faithful Dual-Constrained Erasure for Robust LLM Safety Alignment

Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models LLMs. However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicio...

Learning Normal Diffusion Dynamics for Backdoor Defense in Text-To-Image Models

Backdoor attacks pose a serious threat to the secure deployment of text-to-image T2I diffusion models. Existing defenses typically detect backdoors from specific abnormal patterns in internal representations, which may limit their generalizability with the emergence of increasingly diverse attack...

Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems

As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show th...

Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics

Recently, Vision-Language-Action VLA models have revolutionized robotic manipulation by seamlessly integrating visual perception, language understanding, and action generation in an end-to-end learning framework. However, since these models are designed to interact directly with the physical worl...