StratFL: Countering Covert Model Poisoning Attacks with Strategic Federated Learning

Advanced persistent threats APTs are a major concern in federated learning FL deployments in critical sectors such as healthcare, and finance. Traditional defense mechanisms fail to contain APTs due to their intermittent attacking behavior. This paper addresses a specific type of APT called cover...

MAppPrint: Robust and Real-Time Mobile App Fingerprinting Via Traffic Behavior Correlation Graphs

Mobile apps have become ubiquitous in daily life. Despite communication encryption, app fingerprinting AF attacks can still enable adversaries to infer the apps in use by analyzing patterns of encrypted network traffic. However, existing AF attacks suffer from three critical limitations that hind...

Benchmarking Post-Quantum Key Encapsulation in S3-Compatible Object Storage under Client Concurrency

Data encrypted today with classical public-key algorithms could be decrypted once large quantum computers exist. Cloud object stores keep data for years, so the client-side encryption that protects it must move to post-quantum algorithms such as ML-KEM, which adds a key-encapsulation step and a...

PT-2026-115120

Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The fetch implementation in this Node.js HTTP client library incorrectly verifies Subresource Integrity SRI metadata. The library matches the algorithm toke...

UBUNTU-CVE-2026-110261

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-109841: Improper Handling of Case Sensitivity

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization

Matoi separates reusable consequence evidence from current execution authority and durable occurrence history. Its finite query-aware contract covers branches, ordered collections and negative lookups. A consumer reuses only its own checked evidence whose observations remain valid; signed request...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.3 - exec: Cleanup POSIX timers right after dethread Hyunwoo Kim Orabug: 40157515 CVE-2026-98260 5.15.0-325.221.6.2 - eventpoll: fix epremove struct eventpoll / struct file UAF Christian Brauner Orabug: 39784995 CVE-2026-46242 - eventpoll: move epifget up Christian Brauner Orabug:...

SUSE SLES15: mgradm / mgradm-bash-completion / mgradm-lang / etc (SUSE-SU-2026:2774-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2774-1 advisory. Release Notes Highlights: - Update to SUSE Multi-Linux Manager 5.1.4 Added note about migration for SUSE Linux Enterprise Server 16 on SSH...

Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access and IBM Security Verify Access (CVE-2026-109126)

Summary Security vulnerability has been addressed in IBM Verify Identity Access and IBM Security Verify Access. Vulnerability Details ID: CVE-2026-109126 DESCRIPTION: IBM Security Verify Access Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub (Db2IC)

Summary Dependency updates and code fixes were done to fix multiple vulnerabilties found in Db2 intelligence center. Vulnerability Details CVEID:CVE-2026-109838 DESCRIPTION: IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptograph...

Exploit for CVE-2026-109506

CVE-2026-109506: Improper Authentication in Multiple TP-Link W...

Improper Certificate Validation

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Improper Certificate Validation in the client SSL context cache of the SslContextManager class, whose cache key compared only the key and trust options and...

Security Bulletin: IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting (XSS) vulnerability

Summary IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting XSS vulnerability that allows an authenticated user to embed arbitrary JavaScript into the Web UI. This could alter intended application behaviour and potentially lead to credentials disclosure within a trusted...

CVE-2026-102899

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2026-102899 Sentry: Improper authentication on SAML SSO process allows user identity linking

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2026-102899 Sentry: Improper authentication on SAML SSO process allows user identity linking

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2026-102899 Sentry: Improper authentication on SAML SSO process allows user identity linking

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2026-102899

The application monitoring platform Sentry is vulnerable to account takeover via a flaw in its SAML SSO identity-linking flow . An attacker controlling a SAML identity provider can socially engineer an authenticated user into visiting a malicious URL. If the user's browser accepts cross-site cook...

EUVD-2026-101578

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...