CVE-2026-2472

CVE-2026-2472 concerns Google Cloud Vertex AI SDK (google-cloud-aiplatform). The vulnerability resides in the _genai/_evals_visualization component and affects versions from 1.98.0 up to, but not including, 1.131.0. It enables a stored XSS where an unauthenticated remote attacker can inject scrip...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1103 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1103 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: SNYK:JS-FASTXMLPARSER-15324289...

RUSTSEC-2026-0017 `clob-sdk` was removed from crates.io for malicious code

This is part of an ongoing campaign to attempt to typosquat crates in the polymarket-client-sdk ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-20 approximately 4 hours before removal and had no evidence of actual downloads. There were no crates...

`clob-sdk` was removed from crates.io for malicious code

This is part of an ongoing campaign to attempt to typosquat crates in the polymarket-client-sdk ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-20 approximately 4 hours before removal and had no evidence of actual downloads. There were no crates...

Silicon Labs Simplicity SDK 安全漏洞

Silicon Labs Simplicity SDK is a core software development kit provided by Silicon Labs, Inc. in the United States. The Silicon Labs Simplicity SDK has a security vulnerability that stems from integer underflow, which may lead to excessive buffer reads through specially crafted data packets...

PT-2026-21290

Name of the Vulnerable Software and Affected Versions Google Cloud Vertex AI SDK google-cloud-aiplatform versions 1.98.0 through 1.130.9 Description A Stored Cross-Site Scripting XSS issue exists in the genai/ evals visualization component of Google Cloud Vertex AI SDK. This allows an...

CVE-2026-26267

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the contractimpl macro contains a bug in how it wires up function calls. contractimpl generates code that uses MyContract::value style calls even when it's processing the trait version. This means if a...

CVE-2026-26267

The CVE-2026-26267 issue affects soroban-sdk-macros prior to versions 22.0.10, 23.5.2, and 25.1.1. The macro’s trait-implementation wiring can cause the generated call to resolve to an inherent function (MyContract::value) instead of the trait function when an identically named inherent function ...

CVE-2026-26267 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the contractimpl macro contains a bug in how it wires up function calls. contractimpl generates code that uses MyContract::value style calls even when it's processing the trait version. This means if a...

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Impact: An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. Patches: The problem has been fixed in python-1.39.4. Users should upgrade this version or higher. Workarounds: Avoid using InMemoryVectorSto...

GHSA-XJW9-4GW8-4RQX Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Impact: An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. Patches: The problem has been fixed in python-1.39.4. Users should upgrade this version or higher. Workarounds: Avoid using InMemoryVectorSto...

PYSEC-2026-163

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

CVE-2026-26030

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

PYSEC-2026-163

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

CVE-2026-1368

The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key...

PT-2026-20868

Name of the Vulnerable Software and Affected Versions Semantic Kernel Python SDK versions prior to 1.39.4 Description A remote code execution issue exists within the InMemoryVectorStore filter functionality. Recommendations Update to version 1.39.4 or higher. As a temporary workaround, avoid usin...

@flutchai/flutch-sdk (>=0.2.7, <=0.5.0) potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.5.0 Source cves: CVE-2026-27022 Source advisory:...