OSV-2025-1064 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476224468 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

Enhancing Fuzz Testing Efficiency through Automated Fuzz Target Generation

Fuzzing continues to be the most effective method for identifying security vulnerabilities in software. In the context of fuzz testing, the fuzzer supplies varied inputs to fuzz targets, which are designed to comprehensively exercise critical sections of the client code. Various studies have...

fantasy-analysis (>=0.0.0, <=0.0.3), gam (1.1.1) potentially affected by CVE-2026-23528 via distributed (2021.2.0)

distributed PYPI version 2021.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - fantasy-analysis =0.0.0, =0.0.3 - gam 1.1.1 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

calitp-data-analysis (>=2023.9.18, <=2024.5.24) potentially affected by CVE-2026-23528 via distributed (2022.8.1)

distributed PYPI version 2022.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - calitp-data-analysis =2023.9.18, =2024.5.24 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

calitp-data-analysis (>=2023.9.18, <=2024.5.24) potentially affected by CVE-2026-23528 via distributed (2022.8.1)

distributed PYPI version 2022.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - calitp-data-analysis =2023.9.18, =2024.5.24 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

analysis-tools (0.2.1), esi-acme (>=2022.11.0, <=2022.12.0) +2 more potentially affected by CVE-2026-23528 via distributed (2022.10.2)

distributed PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - analysis-tools 0.2.1 - esi-acme =2022.11.0, =0.1.0b1, =0.1.0 - simpeg-drivers 0.1.0b1 Source cves: CVE-2026-23528 Source advisory:...

Shaping a Quantum-Resistant Future: Strategies for Post-Quantum PKI

As the quantum computing era approaches, securing classical cryptographic protocols becomes imperative. Public key cryptography is widely used for signature and key exchange but it is the type of cryptography more threatened by quantum computing. Its application typically requires support via a...

cve-pocs

CVE Proof of Concepts cve-pocs A collection of Proof of C...

4 Outdated Habits Destroying Your SOC's MTTR in 2026

It's 2026, yet many SOCs are still operating the way they did years ago, using tools and processes designed for a very different threat landscape. Given the growth in volumes and complexity of cyber threats, outdated practices no longer fully support analysts' needs, staggering investigations and...

Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale

The rise of AI agent frameworks has introduced agent skills, modular packages containing instructions and executable code that dynamically extend agent capabilities. While this architecture enables powerful customization, skills execute with implicit trust and minimal vetting, creating a...

Multi-Agent Taint Specification Extraction for Vulnerability Detection

Static Application Security Testing SAST tools using taint analysis are widely viewed as providing higher-quality vulnerability detection results compared to traditional pattern-based approaches. However, performing static taint analysis for JavaScript poses two major challenges. First,...

Malicious code in webmd-page-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3ac133760e765dbcb76befb93e31a79e19da15b27c94d4b5da3b8e43c00f2b1 The package webmd-page-common was found to contain malicious code. Source: ghsa-malware...

Malicious code in silvermine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b977fbc50506142e7db68fc536bdfd96ccfa135ff0c03f3957d24b716cc4441 The package silvermine was found to contain malicious code. Source: ghsa-malware 194377d773e651f6f01c9662fac716fb338b55f83baafc1c503b692fe1195e5a Any...

MAL-2026-257 Malicious code in silvermine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b977fbc50506142e7db68fc536bdfd96ccfa135ff0c03f3957d24b716cc4441 The package silvermine was found to contain malicious code. Source: ghsa-malware 194377d773e651f6f01c9662fac716fb338b55f83baafc1c503b692fe1195e5a Any...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis A com...

VulnCheck KEV: CVE-2020-26836

SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...

SAP Wily Introscope Enterprise Manager Code Execution

The vulnerability of the advanced analysis application, which allows for the creation of custom monitoring panels and detailed examination of server metrics related to SAP Workstation systems, for data collection, storage, and display is related to improper code generation. Exploiting this...

Malicious code in ts-tweetnacl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fc02aaeff144bdf5547d650cfae75b4f8861d765cafa72a8bd01609b8be299b The package ts-tweetnacl was found to contain malicious code. Source: ghsa-malware b8c7022964715c8d5771f3663406b7b80018244bca155ecad7064ba3d2b2ce5e A...

CVE-2025-68820

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4rawinode If ext4getinodeloc fails e.g. if it returns -EFSCORRUPTED, iloc.bh will remain set to NULL. Since ext4xattrinodedecrefall lacks error checking, this will lead to a null pointer...

Security Bulletin: Due to use of Apache Commons Text, IBM Operations Analytics - Log Analysis is affected by Remote Code Execution Attacks

Summary Apache Commons Text in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the string manipulation and interpolation. CVE-2025-46295. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features...