All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
A comprehensive survey reviews adversarial attacks and defenses in image classification, organizing the most representative methods chronologically and by category. It analyzes the strengths and weaknesses of each method and offers perspectives on future research directions. The survey was published in ACM Computing Surveys on 2026-10-29 (DOI: 10.1145/3831673).
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contain an unchecked return value that leads to a NULL pointer dereference. An unauthenticated, remote attacker can trigger it to make the device reload unexpectedly, causing a denial of service (DoS) condition.
Ted Sanders explains OpenAI's model naming conventions, stating that LLM performance is multidimensional but largely tracks model size. He says version numbers now signal release order, relationship to other releases, and the magnitude of improvement, so a model like 6.1 follows 5.6 and is not a large enough leap to be called 7.
MITRE ATLAS released data version v2026.10, containing 1 matrix, 16 tactics, 129 techniques, 92 sub-techniques, 44 mitigations, 77 case studies, 44 entities, and 37 software records. The update adds techniques such as Develop Capabilities: Malware, Training Data Information from AI Models, and Data from AI Services: System Instructions, and renames several AI supply chain and proxy-model techniques. It also adds four mitigations and updates many existing ones.
Anthropic's public benefit corporation (PBC) structure may create tension for IPO investors, since its board must balance stockholder returns against its stated public benefit purpose. Legal experts quoted in the article say the PBC obligation to "balance" these interests is ambiguous and hard to enforce in damages claims. The company targets a valuation of $1.5 trillion or more, and seven co-founders hold 50.1% of voting power through a single Class F share.
`langgraph deploy --verbose` in `langgraph-cli` 0.4.15 through 0.4.31 printed the temporary registry push token that the CLI passes to `docker login --password-stdin`. Anyone who could read that output, such as CI logs, could use the token for up to 12 hours, limited to the deployment's image repository, to pull images and push new ones.
Fix: Upgrade to `langgraph-cli` 0.4.32 or later. 0.4.37 also stops `--verbose` from printing the input of any command the CLI runs. Tokens printed more than 12 hours ago have expired.
LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. An authenticated user may then read, overwrite, search, or delete another user's Store data, provided the handler relies on namespace rewriting and multiple users' data is stored through that path.
Fix: Fixed in langgraph-api version 0.15.0; users should upgrade to langgraph-api>=0.15.0. Deployments that cannot upgrade immediately should change JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than rewriting them, applied to every Store action the deployment exposes.
filelock versions 4.1.0 through 4.2.0 ship SoftReadWriteLock and AsyncSoftReadWriteLock, which check the `<path>.rw`, `gen` and `holders` directories for symbolic links only once per lock object. A local user who can write the lock's parent directory, or who pre-creates `<path>.rw` in a sticky directory such as `/tmp`, can swap in a tree whose `gen` or `holders` links into the lock user's directories. The lock user's long-running process then creates, renames and deletes files there with its own privileges. Anthropic's OSS Scanner reported it as ANT-2026-WXXRI4M4, and the advisory scores it CVSS 3.3 (Low).
The `StrictSoftFileLock` and `AsyncStrictSoftFileLock` classes in filelock versions 3.30.0 through 4.2.0 create their claim directories with a bare `mkdir()`, so the caller's `mode` does not apply to them. Another local user with a write bit on those directories can unlink a live holder's `0600` claim files, letting a second process enter the lock while the first still reports `is_locked == True`. The scanner rated it CVSS 5.3 (Medium) under CWE-732 and tracks it as GHSA-6627-m3xw-93mp.
The `StrictSoftFileLock`, `AsyncStrictSoftFileLock`, `SoftReadWriteLock` and `AsyncSoftReadWriteLock` classes in filelock 3.30.0 through 4.2.0 adopt an existing protocol directory (`<path>.filelock/claims` or `<path>.rw/{gen,holders}`) after checking only that it is a real directory, not who owns it. A local user who creates that directory first in a shared directory such as `/tmp` can delete the lock user's claims, letting a second process enter the critical section without error, and against `SoftReadWriteLock` can redirect file writes or stall acquires. The finding is tracked as CVE-less GHSA-9c4x-gm8v-wgc4 (ANT-2026-Q5VK5JEE), rated CVSS 6.3 (Medium).
On Windows, filelock's WindowsFileLock ignores the mode argument, so a FileLock created with mode=0o600 receives no security descriptor of its own and inherits the access list of its directory, as does the ReadWriteLock SQLite database. Where the directory's inheritable ACL grants other local accounts access to new files, those accounts can open the lock file or database, take the byte-range lock, and read holder metadata. Affected versions are filelock 3.10.0 through 4.2.0 on Windows.
filelock's SQLite-backed ReadWriteLock and AsyncReadWriteLock run PRAGMA journal_mode=MEMORY on every acquire, which makes SQLite load the schema of whatever file is at the lock path. A local user who can place or overwrite that file can make every acquire_read and acquire_write ignore timeout and blocking=False, stalling processes for as long as they choose or indefinitely, with CPU spinning and Ctrl-C ignored. Affected versions are filelock 3.20.4 through 4.2.0; the advisory is GHSA-cwqr-hh33-gh44, scored CVSS 3.1 5.5 (Medium), reported by Anthropic's OSS Scanner as ANT-2026-NFPRHMYJ under CWE-400.
The filelock soft-lock classes (SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants, and FileLock falling back to a soft lock on ENOSYS) decide whether a lock holder is gone from the PID recorded in the marker file without checking who wrote that record. A local user who can write but not remove the marker can rewrite the holder's PID to a dead one, so a contender of the holder's account or root removes the live marker and acquires the lock, letting two processes run the critical section together. Affected versions are filelock 3.22.0 through 4.2.0 (ANT-2026-W1H9NXUH).
filelock versions 3.32.6 through 4.2.0 contain a symlink TOCTOU flaw in raise_on_not_writable_file(), which SoftFileLock and the locks sharing its acquire path call before each attempt. A local user who can create entries in the lock's directory can swap the lock path between a file and a symlink, so the lock user's acquire() reveals whether a chosen path exists and is writable by that user, one bit per acquire, with no content read or written. Linux fs.protected_symlinks blocks the attack in sticky world-writable directories such as /tmp, but not in 0777 directories without the sticky bit or in sticky group-writable ones.
filelock's UnixFileLock, the backend of FileLock and AsyncFileLock on Unix, truncates any regular file found at the lock path once it holds the flock, and chmods it when an explicit mode is set. Another local user who renames or hard-links a file of the lock user onto the lock path causes that file to be emptied by the lock user's next acquire(). Affected versions are all releases up to and including 4.2.0; the chmod behaviour dates from 3.10.2.
filelock versions 3.30.0 through 4.2.0 have a symbolic link following flaw in StrictSoftFileLock and AsyncStrictSoftFileLock. A local user who can rename the `<path>.filelock` directory can swap in a symbolic link after the lstat check, so that claims directories and claim files are created in a directory that user chooses, with the lock user's privileges. Pointed at another strict lock's directory, the stranded claims can deny that lock to every process until an operator force-breaks them.
The LangGraph Python SDK v3 streaming client, in `langgraph-sdk` versions 0.4.0 through 0.4.5, inserts caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them, in the `get_tree` and `_fetch_state` implementations. Relative path segments in these values can redirect an authenticated GET request to another readable path on the configured server, and the SDK returns that response to the application. `RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when it pairs with a vulnerable SDK version.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-11-01.
CISA Known Exploited VulnerabilitiesThis scoping review maps 163 peer-reviewed studies on Agentic AI published between 2017 and June 2026, drawn from IEEE Xplore, Scopus and ScienceDirect under PRISMA-ScR guidance. It identifies recurring architectural patterns such as governance middleware, multi-agent coordination and memory-enabled agency, and reports risks including memory poisoning, unsafe tool use, privacy leakage and prompt injection. Its application-domain proportions proved sensitive to database coverage, while the architectural signals stayed stable.
Fix: Upgrade `langgraph-sdk` to version 0.4.6 or later. If you use `RemoteGraph`, also upgrade `langgraph` to version 1.2.14 or later, which requires `langgraph-sdk>=0.4.6`.
Researchers red-teamed Jev, a typed decision model that answers in a single query, using a fast black-box attack that calls no attacker language model. Across 12 datasets, Jev resisted common prompt injections in 10,240 paired tests, but short universal suffixes flipped confident answers within minutes, with one suffix per dataset flipping 43% of unseen documents. Suffixes generated for one task also flipped 90-100% of samples in other tasks.