CVE-2026-15534

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

Malicious Package

Overview cubesat-upstream-driver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

ShadowAI-Watch: Bringing AI Agent Activity Out of the Shadows

AI agents are rapidly becoming part of everyday development. They operate inside terminals, IDEs, and internal workflows, helping users write code, troubleshoot problems, and automate repetitive tasks. But their capabilities can extend far beyond what users see in the chat interface or terminal...

Telemetry and Concealment in Self-Adapting Generative AI: Logging Architecture, Adversarial Model Hiding, and the Limits of Detection

Model risk management MRM guidance assumes a static model lifecycle, in which models are developed, independently validated, and implemented without further autonomous modification. Continually self-adapting generative AI systems --- models that update their own weights during production deployme...

Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbd4923fdddd3bf528bfd2bc560ffe7963b22ed9df844e60f6fe2f778f15720 Package [email protected] contains only two files and shows no code performing credential access, network...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...

Ghostlink_lite

GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...

EUVD-2026-54745

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

Security Bulletin:IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service.

Summary IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service, or remote code execution. Vulnerability Details...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

EUVD-2026-54726

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

Understanding Security and Privacy Perceptions of Content Creators Regarding AI Labels of AI-Generated Content

AI labels, typically implemented via underlying tracing mechanisms such as watermarks and metadata, are crucial for protecting Artificial Intelligence-Generated Content AIGC against security threats like disinformation and evasion. However, the perceived devaluation of AI-assisted work discourage...