Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime...

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

GHSA-7XPR-HC2W-34M9 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799 Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented IOException...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the skipGroup function. An attacker can cause a service crash by sending a crafted protobuf payload with a negative length in a length-delimited field inside a group, leading to an unchecked runtime...

freerdp: FreeRDP heap-buffer-overflow

A heap based buffer overflow flaw has been discovered in FreeRDP. In affected versions RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndrreaduint8Array...

PT-2026-41958

Name of the Vulnerable Software and Affected Versions go-git versions prior to v5 Description The SSH transport in go-git constructs the remote exec command by wrapping the repository path in single quotes but fails to escape single quotes embedded within that path. This allows a repository path...

PT-2026-42032

Name of the Vulnerable Software and Affected Versions wire-runtime versions prior to 6.3.0 wire-runtime-jvm versions 5.3.1 and 5.3.3 Wire 7 alpha versions prior to 7.0.0-alpha03 Description In the wire-runtime component, the ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup functions fai...

GHSA-J8P6-96VP-F3R9 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

Summary Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated...

iskorotkov/avro: Integer Overflow in Decoder

Integer Overflow in Avro Decoder Summary Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets GOARCH=386, arm, mips,...

PT-2026-41799

Name of the Vulnerable Software and Affected Versions iskorotkov/avro versions prior to 2.33.0 github.com/hamba/avro/v2 versions prior to 2.32.0 Description Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before...

CVE-2025-15023

creationtimestamp| type| source ---|---|--- 2026-05-17 15:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm2mvjiwjf2e...

CVE-2026-42334

creationtimestamp| type| source ---|---|--- 2026-05-17 14:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm2jkjeyun2z...

CVE-2026-44714

creationtimestamp| type| source ---|---|--- 2026-05-16 16:03:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mly7qyq2jx2n...

CVE-2026-8398

creationtimestamp| type| source ---|---|--- 2026-05-15 10:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv35uqdzj2k 2026-05-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f...

CVE-2026-4094

creationtimestamp| type| source ---|---|--- 2026-05-15 07:33:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlusxccsji2q...

CVE-2026-6514

creationtimestamp| type| source ---|---|--- 2026-05-14 09:46:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlsjwyll2e2r...

CVE-2026-6073

creationtimestamp| type| source ---|---|--- 2026-05-14 07:52:53+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-14 2026-05-14 09:07:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlshrdvr4t2r 2026-05-14 18:00:00+00:00| seen|...

CVE-2026-46419

creationtimestamp| type| source ---|---|--- 2026-05-14 03:54:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlrwasixhi2k...

CVE-2026-41520

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been...

CVE-2026-41953

creationtimestamp| type| source ---|---|--- 2026-05-13 17:56:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlqut4k6h62n 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/f5-products-multiple-vulnerabilities20260515...