CVE-2026-63446

creationtimestamp| type| source ---|---|--- 2026-09-18 22:04:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvt6e2p3mj2s 2026-09-25 03:50:08+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117329638373190044 2026-09-25 04:00:06+00:00| seen|...

CVE-2026-68928

creationtimestamp| type| source ---|---|--- 2026-09-18 22:03:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvt6dlt7ce2z 2026-09-23 17:30:30+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mw7bfioxeo2n 2026-09-23 17:30:53+00:00| seen|...

CVE-2026-92708

creationtimestamp| type| source ---|---|--- 2026-09-18 21:03:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvt2xjofgx2b 2026-09-23 05:01:33+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117318594830374371 2026-09-23 05:01:34+00:00| seen|...

CVE-2026-93690

creationtimestamp| type| source ---|---|--- 2026-09-18 17:05:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsnognac42p...

CVE-2026-87743

creationtimestamp| type| source ---|---|--- 2026-09-18 14:05:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsdn3q3o422...

CVE-2026-17086

creationtimestamp| type| source ---|---|--- 2026-09-18 07:05:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvrm4ml4d222 2026-09-18 08:01:54+00:00| seen| https://gist.github.com/ichintu/9a770166efbedcb3b1cdb5d53a11b389...

CVE-2026-18912

creationtimestamp| type| source ---|---|--- 2026-09-18 07:04:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvrm44fn7e2s 2026-09-18 11:12:02+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvrzw4mufn2o...

CVE-2026-93452

creationtimestamp| type| source ---|---|--- 2026-09-18 03:03:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvr6nbjycr22...

CVE-2026-93450

creationtimestamp| type| source ---|---|--- 2026-09-18 03:03:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvr6mzx7zb24...

open-source protobuf GRPC decoder DoS

The vulnerability of the decoder in open-source libraries for working with protobuf and GRPC Wire is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

CVE-2026-63126

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:08+00:00| published-proof-of-concept| https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc...

EUVD-2026-80937

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 incomplete fix of CVE-2026-45799...

GHSA-9RM7-3QHH-H2MC Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decodeByteArray and ProtoAdapter.decodeByteString use the ProtoReader32 fas...

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decodeByteArray and ProtoAdapter.decodeByteString use the ProtoReader32 fas...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

com.squareup.retrofit:converter-wire (>=1.2.1, <=1.2.2), com.squareup.wire:wire-compiler (1.0.1) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.0.1)

com.squareup.wire:wire-runtime MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire =1.2.1, =1.2.2 - com.squareup.wire:wire-compiler 1.0.1 -...

com.squareup.wire:wire-compiler (1.1.1), com.squareup.wire:wire-gson-support (1.1.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.1.1)

com.squareup.wire:wire-runtime MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.1.1 - com.squareup.wire:wire-gson-support 1.1.1 Source cves:...

com.squareup.retrofit:converter-wire (>=1.3.0, <=1.6.0), com.squareup.wire:wire-compiler (1.2.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.2.0)

com.squareup.wire:wire-runtime MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire =1.3.0, =1.6.0 - com.squareup.wire:wire-compiler 1.2.0 -...

com.squareup.wire:wire-compiler (1.3.3), com.squareup.wire:wire-gson-support (1.3.3) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.3)

com.squareup.wire:wire-runtime MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.3 - com.squareup.wire:wire-gson-support 1.3.3 -...

com.squareup.retrofit:converter-wire (1.6.1), com.squareup.wire:wire-compiler (1.5.1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.1)

com.squareup.wire:wire-runtime MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire 1.6.1 - com.squareup.wire:wire-compiler 1.5.1 -...