🕵️ RESEARCH & DEEP DIVES
CVE-2026-86271: Missing authorization flaw in FluentCMS GetAccessible function disclosed
A missing authorization vulnerability (CVE-2026-86271) was disclosed in FluentCMS up to 0.0.5.- Affects FluentCMS versions 0.0.1 through 0.0.5, a Blazor-based CMS.
- The flaw is in the GetAccessible function of src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs (CWE-862, missing/incorrect authorization).
- Remote manipulation of unknown input bypasses authorization checks; exploit requires high privileges (CVSS 4.0 score 5.1).
- A public exploit exists and was disclosed via GitHub issue fluentcms/FluentCMS#2409; the project has not responded.
- Reported by volksec and assigned by VulDB; disclosed 2026-09-06.
Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ash... — CVE ThreatInt
An out-of-bounds write caused by numeric truncation Samsung Open Source Escar... — CVE ThreatInt
itsourcecode School Management System User_Login.php sql injectionA vulnerabi... — CVE ThreatInt
itsourcecode Information System Society Membership System check_student.php s... — CVE ThreatInt
sfturing ssm_pro Order Endpoint OrderController.java cross site scriptingA fl... — CVE ThreatInt
Blockchain-Enabled Secure Logging for Fiscal Electronic Mechanisms: Evaluation of the Greek eSEND and myDATA Tax Systems — arXiv cs.CR
Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys — arXiv cs.CR
Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection — arXiv cs.CR
Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing — arXiv cs.CR
Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research — arXiv cs.CR
Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning — arXiv cs.CR
Hoss: Fast Oblivious Semantic Search with Heterogeneous GPU-CPU-TEE Architecture — arXiv cs.CR
Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection — arXiv cs.CR
Optimizing Credential Blast Radius Through Trust Boundaries and Delegation Under Post-Quantum Authentication Costs — arXiv cs.CR
Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection? — arXiv cs.CR
Memory-Efficient Designs for Word-Wise Universal Fully Homomorphic Encryption — arXiv cs.CR
Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity — arXiv cs.CR
Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution — arXiv cs.CR
Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents — arXiv cs.CR
ReCAST: Restoration-aware Cascaded Stage-wise Training for Obfuscated SMS Risk Classification — arXiv cs.CR
The Security Feature Location Problem — arXiv cs.CR
Robust Coverless Linguistic Steganography via Sentence Embedding Space with Global Resynchronization — arXiv cs.CR
TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage — arXiv cs.CR
Has MIMO decoding been proved hard from lattice problems? — arXiv cs.CR
Operational Roles of QRNG-Derived Quantum Entropy in Bitcoin Proof-of-Work Architectures — arXiv cs.CR
Is Hotel WiFi Safe? — securityboulevard.com (discovered)