square vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 20264

Newest CVEs

• CVE-2026-109391

  Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

  Square · Squash

  Critical9.2
• CVE-2026-61695

  Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

  square · wire

  High7.5
• CVE-2026-63126

  Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

  square · wire

  High7.5
• CVE-2026-45799

  Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

  square · wire

  High7.5
• CVE-2024-58103

  Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

  Square · Wire

  Medium5.8
• CVE-2020-36645

  square squalor sql injection

  square · squalor

  Medium5.5