🕵️ RESEARCH & DEEP DIVES
CVE-2026-90857: Unrestricted upload flaw in SourceCodester College Notes Gallery Management System 1.0
An unrestricted file upload vulnerability was disclosed in SourceCodester College Notes Gallery Management System 1.0.- Affects SourceCodester College Notes Gallery Management System 1.0, specifically the Profile Upload component at /dashboard/userprofile.php.
- Manipulating the 'image' argument allows unrestricted file upload; the attack can be initiated remotely by authenticated users.
- A public exploit is available; CVSS 3.1 score is 6.3 (Medium).
- Reported by OnlyCMJB via VulDB (VDB-403414), disclosed 2026-09-14.
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation — SecurityWeek
D-Link DSL-3782 Diagnostics Diagnostics.asp system command injectionA securit... — CVE ThreatInt
zyx0814 FilePress Publish search.php sql injectionA vulnerability was identif... — CVE ThreatInt
vllm-project vLLM Jinja Template Rendering completions resource consumptionA ... — CVE ThreatInt
SourceCodester Online Faculty Clearance System update_requirement_status.php ... — CVE ThreatInt
SourceCodester Online Faculty Clearance System delete_requirement.php sql inj... — CVE ThreatInt
subhajitkhan online-clinic-management-system adminappview.php session_start a... — CVE ThreatInt
SourceCodester College Notes Gallery Management System Registration Flow sign... — CVE ThreatInt
SkillAtlas: An Attack Trace Library for Agent Skills — arXiv cs.CR
Principled Detection of Coordinated Manipulation from Aggregate Distortion and Account Reuse — arXiv cs.CR
BadEngram: Backdoor Attack on Gated Memory Components in LLMs — arXiv cs.CR
Canaries in the Bank: Auditing User-Level Privacy in Private Evolution — arXiv cs.CR
Mind the Gap: Detecting Description-Execution Mismatch Attacks in DAO Governance — arXiv cs.CR
EI-DDLGN: Efficient Encrypted Inference with Deep Differentiable Logic Gate Networks under TFHE — arXiv cs.CR
Basis Rigidity of the AES S-box and Generic Rigidity of Inversion under Affine Transformations — arXiv cs.CR
PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks — arXiv cs.CR
PQLN: Post-Quantum Security for the Bitcoin Lightning Network's Off-Chain Surfaces — arXiv cs.CR
Exploring Automated Vulnerability Identification in JavaScript Code Using Large Language Models — arXiv cs.CR
PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents — arXiv cs.CR
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents — arXiv cs.CR
Enforcement of In-Kernel Stateful Security Policies via eBPF — arXiv cs.CR
Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control — arXiv cs.CR
A High-Throughput FPGA Architecture for Real-Time TCP-SYN Scan Detection — arXiv cs.CR
Symmetric Models for Syndrome Decoding — arXiv cs.CR
AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents — arXiv cs.CR
SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills — arXiv cs.CR
The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics — arXiv cs.CR
Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem — arXiv cs.CR
For any fellow Mastodon server admins in the UK, I'm aware of the Social Media Platforms (Ofcom Licensing) Act 2026. — @GossiTheDog@cyberplace.social
Hackers Exploit Critical Cisco Secure Email Gateway Vulnerability in the Wild to Run Malicious Code — Cyber Security News
Revolut Data Breach Via Fake Government Requests – What We Know So Far — Cyber Security News