CVE-2026-54746

Hatchet (a platform for orchestrating background tasks, AI agents, and durable workflows) is affected by a cross-tenant write/DoS vulnerability in the Dispatcher gRPC service . From version 0.40.0 to 0.91.1 , the UpsertWorkerLabels and Unsubscribe RPCs do not verify that the worker_id in the requ...

CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

EUVD-2026-67791

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

GHSA-X7RJ-F32V-7JJG Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share...

CVE-2026-9973-exploit

CVE-2026-9973 Correzione di bug https://chromium-review.googlesource.com/c/v8/v8/+/7822799 root@kitploit: wasmturboshaft Fix Phi handling in Load Elimination some more Multiple Phis can depend on each other, so we have to clear all their replacements up front. Fixed: 509268941 Change-Id:...

firstflagPOISONED

ExploitGym first-flag causality experiment This repository te...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

pmd pmd_releases/7.27.0

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

Exploit for Eval Injection in Langflow

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Ov...

Protect your WhatsApp account with new passkey and 2FA upgrades

WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app. The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest...

Windows-7-EternalBlue-Exploitation

SMB EternalBlue Exploitation — Windows 7 Lab Target Discla...

CVE-2026-58106 Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

CVE-2026-58106 Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

CVE-2026-58106

CodeChecker through 6.28.2 contains an incomplete fix for CVE-2025-40843. In ldlogger-tool-gcc.c:129 , the bounded helper safe_strcpy() is called with the full PATH_MAX size, but the destination is fullPath + 2 , leaving only 4094 bytes. Because safe_strcpy() is a strncpy() that NUL-pads to the f...

CVE-2026-58106 Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

EUVD-2026-67716

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...