CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads "keyLength" and "extrasLength" as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93561

This vulnerability affects the netty-codec-memcache component of the Netty project. A signed/unsigned type mismatch in the Memcache binary codec can cause frame desynchronization , potentially enabling response smuggling . Red Hat rates it CVSS 6.5 (Medium) — network-exploitable with low complexi...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), hmd-cli-repo (>=0.3.149, <=0.3.165) +4 more potentially affected by CVE-2026-102937 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

SUSE CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

SUSE CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-93561: Undefined Security Weakness

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

santa v2026.8

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack...

angr 10.0.0

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

CVE-2026-59944

A flaw was found in Composer, a dependency manager for PHP. A malicious or compromised dependency can bypass existing security measures designed to prevent unauthorized binary path execution. This can occur when Composer processes untrusted cached data or older build artifacts, allowing it to...

Directory Traversal

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Directory Traversal via the handling of symlinked binary pat...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944 Composer: CVE-2026-59946 fix bypass via symlinked package bin path

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944: Improper Limitation of a Pathname to a Restricted Directory

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-44778

Inspektor Gadget (v0.28.0–0.53.1) is an eBPF-based toolset for system inspection on Kubernetes and Linux hosts. The USDT note parser in pkg/uprobetracer/usdt.go lets an unprivileged container crash or OOM-kill the privileged IG process via a crafted ELF. Three defects contribute: getUsdtInfo() do...

CVE-2026-90881

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...

CVE-2026-90881 D-Link DIR-882 CGI Binary dllog.cgi main information disclosure

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...