ai.platon.gora:gora-compiler (>=1.0.0, <=1.1.0), ai.platon.pulsar:gora-shaded-mongodb (0.9) +298 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (>=1.5.0, <=1.11.4)

org.apache.avro:avro-compiler MAVEN version =1.5.0, =1.0.0, =4.5.0, =4.7.11, =1.12.7, =4.5.0, =4.5.0, =1.12.7, =1.12.7, =4.5.0, =1.12.7, =1.9.0, =1.12.7, =4.5.0, =4.5.0, =4.8.5 and more Source cves: CVE-2025-33042 Source advisory: GHSA-RP46-R563-JRC7...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

ai.platon.gora:gora-compiler (>=1.0.0, <=1.1.0), ai.platon.pulsar:gora-shaded-mongodb (0.9) +298 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (>=1.5.0, <=1.11.4)

org.apache.avro:avro-compiler MAVEN version =1.5.0, =1.0.0, =4.5.0, =4.7.11, =1.12.7, =4.5.0, =4.5.0, =1.12.7, =1.12.7, =4.5.0, =1.12.7, =1.9.0, =1.12.7, =4.5.0, =4.5.0, =4.8.5 and more Source cves: CVE-2025-33042 Source advisory: MEND:CVE-2025-33042...

Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation

Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code provenance in practice remains challenging. The most popular technique, called reproducible builds, requires difficult...

[SECURITY] Fedora 42 Update: rust-sccache-0.12.0-3.fc42

Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage...

[SECURITY] Fedora 43 Update: rust-sccache-0.13.0-3.fc43

Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage...

de.derivo.graph-app.dummy:neo4j-plugin-distribution-dummy (>=3.15.0-test-neo4j4.0-multibuild-deployment-snapshot-neo4j-3.4, <=3.15.1-test-deploy-neo4j-plugin-distribution-dummy-snapshot-neo4j-3.4), de.derivo.graph-app:semspect-neo4j-plugin-distribution (>=3.15.0-neo4j-3.4, <=3.16.0-beta-neo4j-3.4) +14 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (3.4.18)

org.neo4j:neo4j MAVEN version 3.4.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - de.derivo.graph-app.dummy:neo4j-plugin-distribution-dummy =3.15.0-test-neo4j4.0-multibuild-deployment-snapshot-neo4j-3.4,...

Google Go Code Execution Vulnerability

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A code execution vulnerability exists in Google Go due to unsafe handling of compiler flags in CgoPkgConfig. An attacker can exploit the vulnerability to execute arbitrary code on...

com.github.workingdog:stixtoneolib_2.12 (0.5), com.github.workingdog:stixtoneolib_2.13 (0.6) +11 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (3.3.9)

org.neo4j:neo4j MAVEN version 3.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.github.workingdog:stixtoneolib2.12 0.5 - com.github.workingdog:stixtoneolib2.13 0.6 - org.neo4j.app:neo4j-server 3.3.9 -...

ROS-20260203-73-0032

A vulnerability in the bpfjitcomp.c component of the Linux operating system kernel is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Rust and Go Directed Fuzzing with LibAFL-DiFuzz

In modern SSDLC, program analysis and automated testing are essential for minimizing vulnerabilities before software release, with fuzzing being a fast and widely used dynamic testing method. However, traditional coverage-guided fuzzing may be less effective in specific tasks like verifying stati...

ROS-20260129-73-0054

A vulnerability in the JIT compiler of Mozilla Firefox, Firefox ESR and Thunderbird email client is related to incorrect code generation control. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality, integrity and availability of protected information...

Google Go security vulnerabilities

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A code execution vulnerability exists in Google Go due to unsafe handling of compiler flags in CgoPkgConfig. An attacker can exploit the vulnerability to execute arbitrary code on...

gcc-toolset-15-binutils security update

2.44-3.1 - Fix a potential illegal memory access when linking a corrupt input file. RHEL-130674...

CVE-2025-13952

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the...

CVE-2025-13952

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the...

CVE-2025-13952

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the...

CVE-2025-13952 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the...

CVE-2025-13952

The Imagination Graphics DDK contains a write use-after-free vulnerability within the GPU shader compiler library (libusc ). This issue occurs when a web page containing unusual GPU shader code is loaded from the internet into the GPU compiler process. Specifically, the shader code triggers a pat...

CVE-2025-13952 GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the...