The New Era of Application Security: Reasoning-Based Agents, Runtime Reality, and Risk Intelligence

Key Takeaways AI reasoning systems improve vulnerability detection in source code, but do not address the full spectrum of application security risk. Modern application security must account for APIs, runtime environments, and externally exposed assets beyond the source repository. Continuous...

gdal:ogr_miramon_fuzzer: Stack-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=6569888155238400 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: ogrmiramonfuzzer Job Type: libfuzzerasani386gdal Platform Id: linux Crash Type: Stack-buffer-overflow READ 5 Crash Address: 0xf6af2c5...

mpv:fuzzer_loadfile: Use-of-uninitialized-value in ff_hNUMBER_sei_message_decode

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=6400061390258176 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfile Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer: Index-out-of-bounds in ff_aac_map_index_data

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5539766564356096 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACLATMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type:...

harfbuzz:hb-vector-fuzzer: Heap-buffer-overflow in hb_svg_append_with_prefix

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5448347908636672 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-vector-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 13 Crash Address:...

ffmpeg:ffmpeg_dem_GXF_fuzzer: Use-of-uninitialized-value in ff_hNUMBER_sei_message_decode

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5383132990996480 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemGXFfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5187303822917632 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

assimp:assimp_fuzzer_stl: Container-overflow in Assimp::BaseImporter::ConvertToUTF8

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5181294291255296 Project: assimp Fuzzing Engine: afl Fuzz Target: assimpfuzzerstl Job Type: aflasanassimp Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x76907f2e0198 Crash...

rdkit:mol_deserialization_fuzzer: Crash in void RDKit::MolPickler::_addRingInfoFromPickle<unsigned char>

Detailed Report: https://oss-fuzz.com/testcase?key=4803008000229376 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldeserializationfuzzer Job Type: libfuzzermsanrdkit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffaffffffffffc Crash State: void...

pcapplusplus:FuzzTarget: Heap-buffer-overflow in pcpp::IPv6Address::IPv6Address

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4683685084594176 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerasanpcapplusplus Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash...

CVE-2025-33017

Summary: The connected documents disclose a Langflow vulnerability (pre-1.9.0) where the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-controlled flow data and executes Python code without sandboxing, causing unauthenticated remote code execution. Impact includes potentia...

PT-2026-26093

Name of the Vulnerable Software and Affected Versions UltraJSON versions 5.10 through 5.11.0 Description UltraJSON, a fast JSON encoder and decoder written in C, is susceptible to a buffer overflow or infinite loop when processing large indent values. Specifically, the ujson.dumps function can...

PT-2026-25977

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1 Description jsPDF, a JavaScript library used for generating PDFs, contains a flaw where insufficient sanitization of user-controlled input within the options argument of the output function allows attackers to...

PT-2026-25983

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions 0.5.6 and earlier Description astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This...

PT-2026-25996

Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...

PT-2026-25988

Name of the Vulnerable Software and Affected Versions Harden-Runner versions 2.15.1 and below Description Harden-Runner, a CI/CD security agent functioning as an EDR for GitHub Actions runners, contains a DNS over HTTPS DoH issue. This allows attackers to circumvent network restrictions imposed b...

PT-2026-26000

Summary /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account...

PT-2026-25991

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an...

PT-2026-25957

CVE: CVE-2026-21994 Vendor: Oracle corporation Product: Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit CVSS: 9.8 Credits: n/a Description: Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects component...

PT-2026-26092

Name of the Vulnerable Software and Affected Versions UltraJSON versions 5.4.0 through 5.11.0 Description UltraJSON, a fast JSON encoder and decoder written in C with Python 3.7+ bindings, contains an accumulating memory leak when parsing large integers outside the range -2^63, 2^64 - 1 within JS...