CVE-2026-18938: Heap-based Buffer Overflow

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

@fernir2/saas-kit (>=0.0.173, <=0.0.207), @fernir2/saas-kit-cli (>=0.1.38, <=0.1.40) +1 more potentially affected by CVE-2026-71476 via @nx/s3-cache (>=5.0.0, <=5.0.7)

@nx/s3-cache NPM version =5.0.0, =0.0.173, =0.1.38, =5.0.0, =5.0.7 Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...

CVE-2026-65549

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-25403

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

EUVD-2026-53979

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-65549

Summary: CVE-2026-65549 concerns the WordPress plugin Jeg Kit for Elementor, affected

CVE-2026-65549

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-25403

Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”

CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-53938

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Security flaws in agent infrastructure from Amazon Web Services AWS, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters,...

CVE-2026-25403: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65549: Deserialization of Untrusted Data

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-8400 Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

MAL-2026-12849 Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...