CVE-2026-35087 Authentication Bypass in Slican telephone exchanges

Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version...

CVE-2026-35087 Authentication Bypass in Slican telephone exchanges

Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version...

Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake

Security teams need high-quality, labeled datasets to train threat hunters and incident responders, validate detection logic, and develop robust analytic models. EvidenceForge helps teams overcome the limitations of anonymized or stale public datasets, while avoiding the cost and complexity of...

SAMD: A Tool for Identifying False Data Injection Scenarios in AI/ML-Enabled Medical Devices

The growing integration of artificial intelligence AI and machine learning ML in medical systems requires effective measures to address emerging security risks. One such risk is that of adversaries introducing false data through vulnerable system components during inference, causing misdiagnosis...

S3C2 Summit 2025-07: Government Secure Supply Chain Summit

Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. The...

PT-2026-43700

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

PT-2026-43701

In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel...

MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents Via User-Generated Content

Mobile graphical user interface GUI agents driven by vision-language models VLMs perceive the screen as rendered pixels and choose actions from what they see, so they cannot reliably separate trusted interface elements from user-generated content. We present MIRAGE Mobile Injection of Realistic...

Relevance As a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents

AI agents augment large language models with external tools such as web retrieval, enabling grounded and up-to-date responses. However, incorporating external content into the generation pipeline can weaken the safety alignment mechanisms that govern model outputs. Prior work shows that enabling...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-2651 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2026-2651 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

allennlp (>=2.8.0, <=2.9.0.dev20211215), allennlp-models (2.8.0) +8 more potentially affected by CVE-2026-4372 via transformers (4.12.5)

transformers PYPI version 4.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.8.0, =0.0.1rc158945962037, =0.1.2, =0.0.12, =0.0.0.116399031, =0.0.0.116461994 - transformers-embedder 1.8.2 Source cves:...

allennlp (>=1.2.0rc1.dev20201022, <=1.2.1), allennlp-models (>=1.2.0rc1.dev20201022, <=1.2.1) +5 more potentially affected by CVE-2026-4372 via transformers (3.4.0)

transformers PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20201022, =1.2.0rc1.dev20201022, =0.0.4, =0.0.1, =2.2.5, =2.3.1 Source cves: CVE-2026-4372 Source advisory:...

allennlp (>=1.0.0rc6.dev20200604, <=1.1.0rc1.dev20200709), allennlp-models (>=1.0.0rc6, <=1.1.0rc1.dev20200709) +29 more potentially affected by CVE-2026-4372 via transformers (2.11.0)

transformers PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200604, =1.0.0rc6, =0.0.1rc1, =0.1.2, =0.1.3, =0.5.2, =0.1.2, =3.0.1, =0.1.0, =1.8.0, =0.12.2.dev2, =0.12.2.dev...

bluecore-models (>=0.11.1, <=0.25.0), orilinx (1.0.1) potentially affected by CVE-2026-4372 via transformers (4.57.5)

transformers PYPI version 4.57.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bluecore-models =0.11.1, =0.25.0 - orilinx 1.0.1 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

allennlp (>=1.0.0rc6.dev20200602, <=1.1.0rc1.dev20200706), allennlp-models (>=1.1.0rc1.dev20200630, <=1.1.0rc1.dev20200706) +6 more potentially affected by CVE-2026-4372 via transformers (2.10.0)

transformers PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200602, =1.1.0rc1.dev20200630, =0.0.6, =2.7.3, =0.2.15, =0.2.0, =0.3.0 Source cves: CVE-2026-4372 Source...

allennlp (>=2.2.0, <=2.2.1.dev20210406), allennlp-models (2.2.0) +14 more potentially affected by CVE-2026-4372 via transformers (4.4.2)

transformers PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.2.0, =1.0.0, =0.1.0, =0.1.0, =0.15.4rc0, =0.0.6, =0.0.1, =1.6.6, =1.7.1 and more Source cves: CVE-2026-4372 Source advisory:...

allennlp (1.3.0), allennlp-models (1.3.0) +3 more potentially affected by CVE-2026-4372 via transformers (4.0.1)

transformers PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.3.0 - allennlp-models 1.3.0 - indic-punct =2.0.7, =1.0.0.dev0, =0.6.1.dev0, =0.6.9 Source cves: CVE-2026-4372 Source advisory...

allennlp (2.9.3), allennlp-models (>=2.9.0, <=2.9.3) +21 more potentially affected by CVE-2026-4372 via transformers (4.18.0)

transformers PYPI version 4.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 2.9.3 - allennlp-models =2.9.0, =0.3.1, =0.2.9, =1.1.1, =0.12.0, =2.0.0, =1.0.0b1, =0.1.0, =0.1.1, =0.1.0, =1.0.1 -...

allennlp (>=1.0.0rc4.dev20200513, <=1.0.0rc6.dev20200601), allennlp-models (>=1.0.0rc4, <=1.0.0rc5) potentially affected by CVE-2026-4372 via transformers (2.9.1)

transformers PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc4.dev20200513, =1.0.0rc4, =1.0.0rc5 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...