CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

lean-cve-poc

CVE-2026-72844: Lean 4 Kernel Soundness Bug Proving0 = 1 axiom-free via nested inductive projection validation bypass. Field| Value ---|--- CVE| CVE-2026-72844 Advisory| VulnCheck VCSA Bug report| leanprover/lean414576 Fix| leanprover/lean414577 Affected| Lean 4 ≤ v4.31.0 / nightly ≤ 2026-07-27...

CVE-2026-48100

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-48100 Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-48100

Prior to version 1.3.0 , the Payy Ethereum L2 zk-rollup suffered from a circuit soundness failure in the agg_agg function. The system failed to verify that the unused tail of a public messages array was zero, allowing a registered prover to insert forged burn messages into a valid proof. This fla...

CVE-2026-48100 Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-48100: Acceptance of Extraneous Untrusted Data With Trusted Data

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, aggagg forwards the compacted message stream from its inner proofs into a public messages: Field; 1000 array, but it never checks that the unused tail of the outer array is zero....

CVE-2026-53671

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...

GHSA-9PWQ-GCRX-WGHH Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

CVE-2026-72705

A flaw was found in Rocq Prover. The guard checker component fails to properly track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint. This oversight allows for the creation of a type that is logically equivalent to its own negation, which can lead to t...

CVE-2026-72703

A flaw was found in Rocq Prover. The guard checker incorrectly processes parameters of nested mutual fixpoints when cross-calls occur between different bodies of the fixpoint. This oversight allows the system to accept non-terminating definitions as structurally decreasing. This critical logical...

CVE-2020-37268

A flaw was found in Coq and Rocq provers. The Print Assumptions feature, which is used to audit the soundness of proofs, fails to report when a definition was created without proper "universe checking" a mechanism to ensure logical consistency. This occurs when the definition is incorporated...

CVE-2026-72703

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. finduniformparameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes th...

CVE-2026-72705

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

CVE-2026-72711

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2020-37268

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

EUVD-2026-65143

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...