CVE-2026-48100

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-48100 Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-48100

Prior to version 1.3.0 , the Payy Ethereum L2 zk-rollup suffered from a circuit soundness failure in the agg_agg function. The system failed to verify that the unused tail of a public messages array was zero, allowing a registered prover to insert forged burn messages into a valid proof. This fla...

CVE-2026-48100: Acceptance of Extraneous Untrusted Data With Trusted Data

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

2026-07-tare-nightbox33-cloud

Tare contest details - Join Sherlock Discordhttps://discor...

EUVD-2020-27302

Malware in sbrugna...

EUVD-2020-27303

Malware in sbrugna...

EUVD-2020-5740

Malware in sbrugna...

EUVD-2020-27304

Malware in sbrugna...

EUVD-2025-15109

Malicious code in bioql PyPI...

CVE-2025-4605 USD File Parsing Memory Allocation Vulnerability

A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service DoS, or cause data corruption...

First-Spammed, First-Served: MEV Extraction on Fast-Finality Blockchains

This research analyzes the economics of spam-based arbitrage strategies on fast-finality blockchains. We begin by theoretically demonstrating that, splitting a profitable MEV opportunity into multiple small transactions is the optimal strategy for CEX-DEX arbitrageurs. We then empirically validat...

PT-2025-25215 · Autodesk · Autodesk Maya

Name of the Vulnerable Software and Affected Versions: Autodesk Maya affected versions not specified Description: A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation issue. This can be leveraged by a malicious actor to cause a...

CVE-2025-4605: Memory Allocation with Excessive Size Value

A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service DoS, or cause data corruption...

CVE-2025-2532

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-2532

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-2532 Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-2532 Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-2532

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. The flaw occurs in parsing of usdc files, due to not validating the existence of an object before operating on it, allowing code execution in the target process. Exploitation requires user interaction (visiting a...

CVE-2025-2532: Use After Free

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...