CVE-2026-109391: Square Squash through commit e73f280 contains a critical unauthenticated YAML deserialization vulnerability via the Symbolication API, potentially leading to code execution. This vulnerability allows attackers to store crafted YAML, which can be deserialized when occurrences referencing the attacker-controlled symbolication UUID are symbolicated, enabling arbitrary Ruby object deserializa [truncated]
A vulnerability in Wire's Swift runtime allows a process trap when decoding untrusted protobuf bytes. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04. The vulnerability arises from the ProtoReader.skipGroup function accepting a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field, potentially causing a process trap. Swift developers and teams should assess exposure and [truncated]
A vulnerability was found in Wire gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to versions 6.3.0 and 7.0.0-alpha03, the ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() methods in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), which can lead to an ArrayIndexOutOfBoundsException. This vulnerability has a CVSS score of [truncated]
