Vulnerabilities and CVEs

01:23 Vulnerability

CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demonstrated) — unfixed since 2020

CVE-2020-37268oss-security

01:21 Exploited

CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day

CVE-2026-72714oss-security

01:20 Vulnerability

CVE-2026-72705: Rocq guard checker accepts fixpoint passed as higher-order argument (0 = 1 demonstrated)

CVE-2026-72705oss-security

01:18 Exploited

CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day

CVE-2026-72704oss-security

01:16 Vulnerability

CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated)

CVE-2026-72703oss-security

01:14 Vulnerability

CVE-2026-72711: Lean 4 kernel soundness bug — inference cache poisoning via opaque declarations (0 = 1 demonstrated)

CVE-2026-72711oss-security

01:12 Vulnerability

CVE-2026-72844: Lean 4 kernel soundness bug — forging proofs via nested inductive projections (0 = 1 demonstrated)

CVE-2026-72844oss-security

01:10 Patch

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata

CVE-2025-60477oss-security

01:00 Vulnerability

Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

JFrog Security Research

01:00 Vulnerability

Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

Elastic Security Labs

00:33 Patch

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security

18:55 Vulnerability

Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

Wiz

18:44 Vulnerability

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

The Hacker News

15:46 Patch

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

CVE-2026-111497Wiz

15:00 Patch

CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability

CVE-2026-102870Microsoft Security Response Center

15:00 Vulnerability

CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability

CVE-2026-114148Microsoft Security Response Center

15:00 Vulnerability

CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

CVE-2026-111497Microsoft Security Response Center

13:28 Vulnerability

Security Affairs newsletter Round 601 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

10:00 Patch

Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Help Net Security

07:54 Vulnerability

🏴☠️ N0n has just published a new victim : Andrews Advisory Group LLC

ransomware.live