CVE-2025-55780

CVE-2025-55780 MuPDF 1.26.4 EPUB 렌더링 함수의 널 포인터 역참조 CVE 참조 - CVE-2025-55780 영향을 받는 버전 : 1.26.7 및 이전 버전 발견 및 테스트 버전 : 1.26.4 심각도 CVSSv3 점수 : 7.5 높음 수정된 커밋 : https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=bdd5d241748807378a78a622388e0312332513c5 Bugzilla :...

[SECURITY] Fedora 45 Update: dicomanonymizer-1-0.22.20210920gitf076264.fc45

A multi-threaded anonymizer for DICOM files implementing most of DICOM PS 3.15 AnnexE. Entries such as uid entries are replaced with hash values. This ensur es that partial runs of a studies DICOM files can be merged afterwards. This project is written in C++ using the gdcm library and multiple...

cve-2022-4543-wrapper

cve-2022-4543-wrapper 소개 이것은 willsroot의 CVE-2022-4543 익스플로잇의 래퍼로, 커널 베이스 주소를 판단하고 얻는 데 도움을 줍니다. 사용 방법 컴파일 필요에 따라 선택 사항: gcc dekaslr.c --static -o dekaslr g++ main.cpp --static -o main 일부 OS에서는 먼저 정적 libc를 설치하세요. De-KASLR ./main Usage: ./binary dekaslrpath entrySYSCALL64offsetin hex maxloop $ ./ma...

CLEANSTART-2026-DS58516 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is...

CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2024-NJ43669 null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request)

Security vulnerability affects the heimdal package. A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request...

CLEANSTART-2026-GK62523 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-LW45744 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the minio-operator package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

Amazon Linux 2023 : rclone (ALAS2023-2026-3129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Important: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Important: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

The vulnerability of the FullyConnected::De serialize function in the Tesseract OCR system allows attackers to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the FullyConnected::De serialize function in the Tesseract OCR system is related to reading data beyond the allowable range in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Handle the return value of hdrfirstde The hdrfirstde function returns a pointer to a struct NTFSDE. This pointer may be NULL. To effectively handle the NULL error, it is important to implement an error handler. This wil...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed a slab-out-of-bounds read in hdrdeletede. Here is a bug report from syzbot: Bug: KASAN: Slab-out-of-bounds in hdrdeletede+0xe0/0x150, fs/ntfs3/index.c:806. A read of size 16842960 was performed at address...

Astra Linux – Vulnerability in Tiff

LibTIFF 4.3.0 has a out-of-bounds read issue in TIFFmemcpy in tifunix.c, especially in situations where a custom tag is used, and 0x0200 is the second value in the DE field...

Medium: runc

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

CVE-2026-75030: Missing Authorization

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass deprovision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0...

Medium: nerdctl

Issue Overview: A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be...

crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello

A flaw was found in the crypto/tls package in Go. Handshakes utilizing Encrypted Client Hello ECH could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link...