Security news for developers, not just security teams.
HackTribune turns supply-chain incidents, framework advisories, and malicious package reports into searchable incident pages, watchlists, and upgrade-worthy alerts.
Latest incidents
View all →Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
(Elixir protobuf is a pure Elixir implementation of Google Protobuf. Fr ...)
(Elixir protobuf is a pure Elixir implementation of Google Protobuf. Fr ...)
(MariaDB Connector/J is used to connect applications developed in Java ...)
(MariaDB Connector/J is used to connect applications developed in Java ...)
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leavi
(A flaw was found in libxml2. A local user or an attacker providing a s ...)
(A flaw was found in libxml2. A local user or an attacker providing a s ...)
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return