Trust Me, I'M Your Developer: Self-Issued Authentication in Large Language Models

Large language model LLM security has largely focused on role-playing jailbreaks, with less attention to what happens when a user asks an LLM to verify an identity claim through a test designed by the model itself. We study this behavior through a staged developer-identity experiment with ChatGPT...

The vulnerability of the `iris_hfi_gen1_session_unset_buffers()` function in the `drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c` driver for multimedia devices in the Linux operating system, which allows a hacker to cause a service failure.

The vulnerability of the irishfigen1sessionunsetbuffers function in the drivers/media/platform/qcom/iris/irishfigen1command.c driver for multimedia devices in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow...

PT-2026-84595

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

PT-2026-84866

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument display name leads to path traversal. An attack has to be approached locally...

PT-2026-84823

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

PT-2026-84586

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger...

PT-2026-84576

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...

PT-2026-84658

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description When using the wolfSSL backend with CA caching enabled, a flaw exists where the CURLOPT SSL CTX FUNCTION callback can be overridden. If this callback replaces the trust store, libcurl may...

The vulnerability of the de265_image_get_buffer() function in the h.265 Libde265 implementation allows a attacker to cause a service failure.

The vulnerability of the de265imagegetbuffer function in the h.265 Libde265 implementation is related to insufficient cleaning of input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

The vulnerability of the vc4_free_hang_state() function in the drivers/gpu/drm/vc4/vc4_gem.c module of the Direct Rendering Infrastructure (DRI) driver for the Linux kernel allows a malicious actor to cause a system crash.

The vulnerability of the vc4freehangstate function in the drivers/gpu/drm/vc4/vc4gem.c module of the Direct Rendering Infrastructure DRI driver for the Linux kernel is related to improper memory release mechanisms memory leaks. Exploiting this vulnerability can allow an attacker to cause a system...

The vulnerability of the kvm_vgic_create() function in the arch/arm64/kvm/vgic/vgic-init.c file of the virtualization subsystem on the ARM 64-bit Linux operating system allows a attacker to cause a service failure.

The vulnerability of the kvmvgiccreate function in the arch/arm64/kvm/vgic/vgic-init.c file of the virtualization subsystem on the ARM 64-bit kernel-based Linux operating system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an...

The vulnerability of the `iris_hfi_gen2_session_stop()` function in the driver/media/platform/qcom/iris/iris_hfi_gen2_command.c file of the multimedia device driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the irishfigen2sessionstop function in the drivers/media/platform/qcom/iris/irishfigen2command.c driver for multimedia devices in the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the amdgpu_userq_input_args_validate() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c source file of the Direct Rendering Infrastructure (DRI) driver for AMD GPU cores in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the amdgpuuserqinputargsvalidate function in the drivers/gpu/drm/amd/amdgpu/amdgpuuserq.c source code of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to incorrect input validation. Exploiting this vulnerability can...

ROS-20260902-73-0017

The vulnerability of the Repo.archive function in the Python library for interacting with Git repositories in GitPython is related to improper external handling of file names or paths when processing the unsafegitarchiveoptions parameter. Exploiting this vulnerability may allow a remote attacker ...

Session fixation vulnerability

Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated vi...

The vulnerability of the JSONTaggedDecoder.decode_obj() function in the Natural Language Processing and symbolic processing library package allows a hacker to trigger a denial-of-service attack.

The vulnerability of the JSONTaggedDecoder.decodeobj function in the Natural Language Processing library for symbolic and statistical processing in NLTK is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

The vulnerability of the deleteMessages() function on the LibreChat artificial intelligence-based platform allows a violator to gain access to the ability to delete any files.

The vulnerability of the deleteMessages function on the LibreChat artificial intelligence-based platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and delete any files they desire...

The vulnerability of the ReadJeffsImage() function in the Gimp image processing library allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the ReadJeffsImage function in the Gimp image processing library is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause service failures or execute arbitrary code...

The vulnerability of the amdgpu_smu_ras_send_msg() function in the drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c file of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the amdgpusmurassendmsg function in the drivers/gpu/drm/amd/pm/swsmu/amdgpusmu.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow an attacker ...

The vulnerability of the fsock_get_contents() function in the elFinder file manager allows a hacker to disclose sensitive information that should be protected.

The vulnerability of the fsockgetcontents function in the elFinder file manager is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to disclose sensitive information that should be protected...