30
57
30
30
Reflection-aware Generative Novel View Synthesis
Ref-GeNVS is a training-free method for reflection-consistent generative novel view synthesis that treats mirror images as two complementary views.
An arXiv paper proposes Ref-GeNVS, a training-free approach to generative novel view synthesis in scenes containing mirrors. It estimates the mirror plane, reflects camera poses to create virtual views, and applies mirror-gated attention plus reflection injection within a multi-view diffusion model. On synthetic and real mirror scenes, Ref-GeNVS outperforms recent generative NVS methods while requiring no fine-tuning.
26
35
45
45
42
30
35
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server
Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.
33
Bilevel Coordinated Reflection: A Game-Theoretic Approach to Multi-Agent LLM Systems
Paper models multi-agent LLM orchestration as a bilevel game, proving transcript-only gating limits and introducing grounded-memory SRMA.
A new paper frames orchestrator-worker coordination in multi-agent LLM systems as a bilevel coordination game and analyzes free-form reflection as stochastic movement over semantic memory states, deriving finite-time bounds and an information-theoretic impossibility result: no gate observing only the generated transcript can uniformly improve over text-indistinguishable environments, while an environment-grounded gate can. The authors propose Stochastic Reflective Memory Ascent (SRMA), which accepts candidate memory only when grounded evaluation risk strictly decreases, with geometric or polynomial convergence guarantees. On 500 SWE-bench instances, a Kimi-based instantiation of the full system resolves 72.2% versus a 70.8% public mini-SWE-agent reference.
32
30
CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41871, an unauthenticated unsafe-reflection job execution flaw in Nutch Server's REST API affecting versions 1.10-1.22.
CVE-2026-41871 describes a Missing Authorization and Unsafe Reflection vulnerability in Apache Nutch Server (the Nutch REST API), rated important by Apache. Affected versions are Apache Nutch 1.10 through 1.22, allowing unauthenticated reflection-based job execution via externally controlled class selection. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
45
[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
A reflected cross-site scripting flaw in Bludit CMS 3.20.0 is documented with a public proof-of-concept exploit on Exploit-DB.
Exploit-DB published exploit ID 52678 targeting Bludit CMS 3.20.0, a web application affected by reflected cross-site scripting. The listing contains a proof-of-concept but includes no CVE identifier or evidence of active exploitation.
12
30
60
30
30
CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.
CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.
25
55
60
60
57
30
60
35
30
30
60
30
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.
85
42
60
30
55
57
45
30