CVE-2026-55407 is a MEDIUM severity vulnerability in the Buffa pure-Rust Protocol Buffers implementation. The issue affects the decode_unknown_field function in Buffa's protobuf decoder, which allocated heap memory in proportion to untrusted input without enforcing an allocation budget. This vulnerability could lead to memory exhaustion through amplification of unknown fields in the serialized protobuf, p [truncated]
A use-after-free vulnerability was discovered in Buffa, a pure-Rust Protocol Buffers implementation, prior to version 0.7.0. The issue is caused by a soundness bug in the OwnedView<V> type, which allows safe Rust code to trigger a use-after-free. This can lead to memory corruption, information disclosure of freed heap contents, and cross-thread misuse. The vulnerability affects Buffa versions prior to 0.7 [truncated]
CVE-2026-47751 is a vulnerability in Claude Code Action, a GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to version 1.0.74, the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers. This allowed an attacker who opened a pull request contai [truncated]
CVE-2026-54316 is a medium-severity vulnerability in Claude Code, an agentic coding tool, affecting versions from 0.2.54 to 2.1.163. The issue arises from the pre-approval of the hostname 'huggingface.co' for the WebFetch tool, enabling an attacker to inject untrusted content and direct the tool to issue requests against attacker-controlled repository files. This could create a covert out-of-band channel [truncated]
