CVE-2026-22036

Undici (HTTP/1.1 client for Node.js) contains a vulnerability in its decompression chain handling. Before versions 7.18.0 and 6.23.0, the chain can have an unbounded number of links, and the default maxHeaderSize allows a malicious server to insert thousands of compression steps, causing high CPU...

exploit-chain-generator

Exploit Chain Generator Turn Noise into Signal: Correlate...

Survey: Rapid AI Adoption Causes Major Cyber Risk Visibility Gaps

As software supply chains become longer and more interconnected, enterprises have become well aware of the need to…...

CVE-2025-68771

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2findvictimchain syzbot reported a kernel BUG in ocfs2findvictimchain because the clnextfreerec field of the allocation chain list next free slot in the chain list is 0, triggring the...

Astra Linux – Vulnerability in OpenSSL

Issue summary: Writing large, newline-free data into a BIO chain using the line-buffer filter, where the next BIO performs short writes, can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption, typically resulting in a crash, leading to a...

Realworld-for-Application_FUGIO_FirstFrameworkFuzzingDetectPOI

FUGIO Production Guide Introduction FUGIO is the firs...

CVE-2026-22187

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files .bfmemo during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity...

PT-2026-1005

CVE-2025-34464 + CVE-2025-34465 reserved for preauth exploit-chains among the last of the year 🥳 Thanks to @catc0n & @VulnCheckAI !...

PT-2026-7113

Name of the Vulnerable Software and Affected Versions Recursor affected versions not specified Description Improperly crafted zones may cause increased resource consumption. Additionally, crafted CNAME chains can lead to cache poisoning within the Recursor. Recommendations At the moment, there is...

PT-2026-1006

CVE-2025-34464 + CVE-2025-34465 reserved for preauth exploit-chains among the last of the year 🥳 Thanks to @catc0n & @VulnCheckAI !...

Malicious code in chai-promised-chains (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0956a62fcaae7fb3ed4d8d30007bc025850ba1f4915e2a816c0602f6d24f2135 The package chai-promised-chains was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205824

Malicious code in chai-promised-chains npm...

Malicious Package

Overview chai-promised-chains is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192984 Malicious code in chai-promised-chains (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0956a62fcaae7fb3ed4d8d30007bc025850ba1f4915e2a816c0602f6d24f2135 The package chai-promised-chains was found to contain malicious code. Source: ghsa-malware...

OESA-2025-2866 golang security update

. Security Fixes: crypto/x509: Exclude subdomain constraints do not restrict wildcard SANs Exclude subdomain constraints in certificate chains do not restrict the use of wildcard SANs in leaf certificates. For example, excluding the constraint on the subdomain test.example.com does not prevent th...

OESA-2025-2865 golang security update

. Security Fixes: crypto/x509: Exclude subdomain constraints do not restrict wildcard SANs Exclude subdomain constraints in certificate chains do not restrict the use of wildcard SANs in leaf certificates. For example, excluding the constraint on the subdomain test.example.com does not prevent th...

OESA-2025-2864 golang security update

. Security Fixes: crypto/x509: Exclude subdomain constraints do not restrict wildcard SANs Exclude subdomain constraints in certificate chains do not restrict the use of wildcard SANs in leaf certificates. For example, excluding the constraint on the subdomain test.example.com does not prevent th...

EUVD-2025-204875

Malicious code in chai-async-chains npm...

Malicious Package

Overview chai-async-chains is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in chai-async-chains (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dfd7db9210fae054def8abcb6989e1158a4774dbec18c08ac6eebcbf95ef753 The package chai-async-chains was found to contain malicious code. Source: ghsa-malware...