com.alanpoi:alanpoi-all (>=1.3.4, <=3.0.0), com.alanpoi:alanpoi-analysis (>=1.3.4, <=3.0.0) +10 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.0)

org.docx4j:docx4j-core MAVEN version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.alanpoi:alanpoi-all =1.3.4, =1.3.4, =3.0.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3.0 -...

com.github.paulcwarren:spring-content-docx4j (>=2.1.0, <=2.3.0), org.docx4j:docx4j-conversion-via-microsoft-graph (8.3.4) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.4)

org.docx4j:docx4j-core MAVEN version 8.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.github.paulcwarren:spring-content-docx4j =2.1.0, =2.3.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3....

GHSA-GGR8-5VV4-36MX DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

Uncontrolled Recursion

Overview deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursiv...

PT-2026-73379

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

slater v0.25.1

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

CVE-2026-72385

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

aquila-graph-poc

Aquila Graph POC A reproducible proof of concept for combinin...

SAEFUZZ: Smart Contract Vulnerability Detection through Statically Guided Evolutionary Fuzzing

The effectiveness of smart contract fuzzing depends strongly on whether generated transactions reach deep, state-dependent execution paths. Existing fuzzers often generate highly random call sequences, wasting executions on semantically invalid or low-value states and leaving vulnerabilities that...

Pre-Model Representation Failures in GNN-Based Smart Contract Vulnerability Detection

This paper is a failure analysis of the representation layer underlying GNN-based smart contract vulnerability detectors. These systems convert source code into graphs before any learning takes place; if the graph fails to capture the code's semantics, no model improvement can compensate. We...

GO-2026-5529 vulnerabilities

Vulnerabilities for packages: dgraph...

MazeRunner: Nonlinear Task and Clue Orchestration for LLM-Driven Black-Box Automated Penetration Testing

Penetration testing is essential yet resource-intensive. Although large language models LLMs show promise for automating security auditing, existing agents mainly execute end-to-end workflows in simplified linear scenarios. Real-world black-box testing is fundamentally nonlinear: the attack graph...

Structural Leakage in Graph Encryption: Attacks and Defenses

Graph encryption schemes GES enable secure outsourcing of graph data while supporting efficient queries. This report provides a comprehensive analysis of structural leakage in GES for single-pair shortest path SPSP queries, integrating findings from two recent works. First, we analyze PathGES, a...

Nuxt OG Image Spoofing

The vulnerability of the og/d/.png component of the Open Graph image generation module, which is part of the Nuxt OG Image framework for creating web applications and sites using Nuxt.js, relates to the loading of unreliable external data alongside reliable data. Exploiting this vulnerability cou...

CoSA: Context-Aware Severity Assessment Via Context Analysis with Large Language Models

Accurate vulnerability severity assessment is essential for prioritizing remediation, yet manually assessing Common Vulnerability Scoring System CVSS base metrics remains labor-intensive. Existing automated approaches often fail to capture the repository-level evidence required for assessing many...

Operationalizing Cyber Threat Intelligence with GraphRAG

When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules. In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn...

CVE-2026-72804 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72922

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...

CVE-2026-73158

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to...

CVE-2026-73158

CVE-2026-73158 affects cti-transmute; saved graph configurations can include style properties and an svgIcon value that Pivotick may render as HTML, enabling script execution in other viewers’ browsers. Root cause: insufficient validation of saved graph configuration data. The fix adds a strict s...