CVE-2026-18790 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-18790 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

Wiz at Black Hat 2026: Driving AI Threat Readiness

Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed...

Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

MAL-2026-12024 Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

CVE-2026-64562

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

UBUNTU-CVE-2026-64562

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

CVE-2026-64562 KVM: nVMX: Hide shadow VMCS right after VMCLEAR

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

CVE-2026-64562

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

EUVD-2026-52603

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

PT-2026-67824

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Orchestrator LXCO version 2.2.0 Description Multiple microservices contain an improper certificate validation flaw. This allows an attacker on the same network to perform a machine-in-the-middle attack against HTTPS connections...

CVE-2026-16792: Improper Certificate Validation

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...

Malicious code in beaver-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece The package is advertised as a React UI layout library but on require'beaver-ui-layout' loads bridge.js, which reconstructs hostnames from array-join...

Exploit for Injection in Vm2_Project Vm2

Hack The Box — Codify Writeup !Difficultyhttps://img.shiel...

Linux kernel MRP: vector attribute parsing errors break applicant state handling

Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...

SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems Via Deterministic Side Channels

Modern large language models LLMs exhibit activation sparsity, wherein only a subset of their neurons is activated for given input tokens. Researchers have leveraged this property to optimize LLM serving systems by omitting weight accesses and computations pertaining to inactive neurons...