autoguardrails

autoguardrails Open source by Santander AI Lab. An LLM / AI-safety guardrail research library / evaluation harness autoresearch-style: it searches over a single mutable policy.md surface to minimize attack success rate ASR against a fixed evaluation suite, with a benign-pass floor. Part of...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

Libssh-server-CVE-2018-10933

libssh Authentication Bypass VulnerabilityCVE-2018-10933 中文版本Chinese version libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. A logic vulnerability was found in libssh's server-side state machine. The attacker can send the MSGUSERAUTHSUCCESS message...

CVE-2026-126619

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-126619: Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7…

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Correct RINGCTRLABORT handling in DMA dequeue The logic used to abort the DMA ring contains several flaws: 1. The driver unconditionally issues a ring abort even when the ring has already stopped. 2. The...

SUSE CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

UBUNTU-CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

CVE-2026-110524 Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2026-110524

The Copy Anything to Clipboard for WordPress plugin (versions before 5.5.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape a shortcode attribute (specifically the 'success-text' attribute) before it is stored and subsequently re...

CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection

Self-evolving personal agents act for users and learn from user feedback. However, if an agent obeys an instruction that an untrusted third party hides in content, the third party gains control of the agent. Such indirect prompt injection IPI poses severe risks. We investigate whether...

CVE-2026-99136: Linux: In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in…

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

VulnCheck KEV: CVE-2026-16947

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

curl: CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Summary: The CVE-2026-7009 fix 51905671e0 made a missing staple fatal when Apple SecTrust verifies the chain, but when a staple is present curl still skips its own verifystatus lib/vtls/openssl.c:4864-4873, !octx-sectrustverified and leaves the staple to SecTrust. SecTrust evaluates it...

Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

Tool-using agents read untrusted external content, which exposes them to indirect prompt injection IPI, where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate ASR, which treats every failed attack as a successful defense. To test this...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot caused KMSAN to complain about accessing an uninitialized value within the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alaudatransport+0x462/0x57f0...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: NFS: Do not corrupt the value of pgbyteswritten in nfsdorecoalesce The value of mirror-pgbyteswritten should only be updated after a successful attempt to flush out the requests on the list...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Free rwi on reset success Free the rwi structure in the event that the last rwi in the list is processed successfully. The logic in commit 4f408e1fa6e1 “ibmvnic: retry reset if there are no other resets” introduces an...