Knowledge over Parameters: Evolving Smart Contract Vulnerability Detection

Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted...

CVE-2026-53351

creationtimestamp| type| source ---|---|--- 2026-07-01 22:46:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlvv3owd2d 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-53340

creationtimestamp| type| source ---|---|--- 2026-07-01 22:26:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkrk2x5l2r 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-14114

creationtimestamp| type| source ---|---|--- 2026-07-01 21:51:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmitplxfe2y 2026-07-02 01:39:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvk3ipal2q 2026-07-02 08:17:28+00:00| seen|...

CVE-2026-14106

creationtimestamp| type| source ---|---|--- 2026-07-01 21:50:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmiruavlx24 2026-07-02 08:16:47+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:46:25+00:00| seen|...

CVE-2026-34111

creationtimestamp| type| source ---|---|--- 2026-07-01 21:44:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmiglyzbt2k 2026-07-02 04:43:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7tpyc5c2y 2026-07-02 09:28:31+00:00| seen|...

CVE-2026-13999

creationtimestamp| type| source ---|---|--- 2026-07-01 21:17:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgwfxuab26 2026-07-02 07:48:50+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:21:14+00:00| seen|...

CVE-2026-14002

creationtimestamp| type| source ---|---|--- 2026-07-01 21:15:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgsnjran2y 2026-07-01 21:15:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmgsniedp23 2026-07-02 07:48:56+00:00| seen|...

MAL-2026-6718 Malicious code in test-pkg-yarn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40b74339843ee482f3f135dd43e855f1f30758e20857333e0e6153748888769a package.json declares bin: "node": "./shim.js" , causing npm/yarn to symlink node in nodemodules/.bin and in a system bin dir on global install to a...

Malicious code in test-pkg-yarn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40b74339843ee482f3f135dd43e855f1f30758e20857333e0e6153748888769a package.json declares bin: "node": "./shim.js" , causing npm/yarn to symlink node in nodemodules/.bin and in a system bin dir on global install to a...

MAL-2026-6717 Malicious code in test-pkg-x0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d0014944456f668a25fa484bf7cb5f36a7128d6a585b86d9294d8d49b23049a Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branches on uname -s...

Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

MAL-2026-6714 Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

MAL-2026-6712 Malicious code in polymarket-risk-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54bfddce038bb64117d6850bb2977f8cee17704212e12e6214fb495b9d4cee79 On npm install, the package's postinstall script reads a config URL from package.json's homepage field...

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

The KILL statement is used to terminate LIVE SELECT subscriptions that capture real-time changes to data within a table. The KILL statement implementation in core/src/expr/statements/kill.rs verifies that the requesting user has database-level access, but does not verify that the requesting user ...

CVE-2026-53467

creationtimestamp| type| source ---|---|--- 2026-07-01 20:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdenqcm72b 2026-07-02 09:56:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnrbw7ifn22 2026-07-02 11:55:52+00:00| seen|...

Fake Perplexity Chrome extension spies on your searches

Type "Perplexity" into the Chrome Web Store and you get a range of browser extensions offering access to the popular AI search service. Until last week, one of them was called "Search for perplexity ai ," and it delivered something extra that users hadn't bargained for: a small hidden surveillanc...

GHSA-XGJW-PM74-86Q4 sigstore-js has Insufficient Verification of Data Authenticity

sigstore-js derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only no signed inclusionPromise/set, and the inclusion proof path does not...

sigstore-js has Insufficient Verification of Data Authenticity

sigstore-js derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only no signed inclusionPromise/set, and the inclusion proof path does not...

GHSA-MJGF-XJ26-9QF9 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...