Square - vulnerabilities (CVEs)

5 CVEs in 4 products, 0 in the last 30 days, newest from 2026-09-23.

Products

• Wire - 4 CVEs
• Squalor - 1 CVEs
• Okhttp - 0 CVEs
• Squash - 0 CVEs

Newest CVEs of Square

• CVE-2026-61695 - CVSS 7.5 (high), 2026-09-23: Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime…
• CVE-2026-63126 - CVSS 7.5 (high), 2026-09-16: Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently…
• CVE-2026-45799 - CVSS 7.5 (high), 2026-07-17: Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and…
• CVE-2024-58103 - CVSS 5.8 (medium), 2025-03-16: Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.
• CVE-2020-36645 - CVSS 9.8 (critical), 2023-01-07: A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection.…