CVE-2026-7482

🚨 CVE-2026-7482：Ollama 中的堆缓冲区越界读取 📝 描述 CVE-2026-7482 标识了 Ollama （一个用于运行本地语言模型的开源框架）中 /api/create 和 /api/push 端点存在的一个严重的堆缓冲区越界读取 （ Heap Buffer Over-Read ）漏洞。 该漏洞允许远程未认证攻击者泄露进程内存 ，暴露敏感数据，例如： API 密钥和认证令牌 环境变量 系统提示词 并发用户的机密数据 🔴 影响： 进程内存完全泄露 ，可能窃取组织的关键信息。 🔍 技术分析 🎯 利用机制 1. 操纵恶意 GGUF 文件 攻击者发送一个 GGUF...

CVE-2026-47729

🦑 CVE-2026-47729 - Squidbleed ⚠️ Heartbleedの古い従兄弟、1997年からSquidに潜んでいる。 ✨ 機能 シングルファイルPoC — 依存関係ゼロ 悪意のあるFTPサーバーがNetWareバナーと切り詰められた LIST 応答を模倣 Basic Auth + Bearer トークンのリアルタイム検出とデコード より高速なリークのためのマルチスレッドヒープスプレー ライブ統計付きのクリーンでカラー化されたコンソール出力 🚀 クイックスタート root@kitploit: git clone...

CVE-2019-19203

CVE-2019-19203 在 Oniguruma 6.x 至 6.9.4rc2 之前版本中发现了一个问题。在文件 gb18030.c 的函数 gb18030mbcenclen 中，一个 UChar 指针在未检查是否超过匹配字符串末尾的情况下被解引用。这会导致基于堆的缓冲区过度读取。 研究人员：ManhND（The Tarantula Team 成员）、VinCSS（Vingroup 成员） 什么是 Oniguruma Oniguruma 由 K. Kosako 开发，是一个采用 BSD 许可证的正则表达式库，支持多种字符编码。Ruby 编程语言 1.9 版本以及 PHP...

CVE-2019-19203

CVE-2019-19203 在Oniguruma 6.x（6.9.4rc2之前版本）中发现了一个问题。在文件gb18030.c的函数gb18030mbcenclen中，在解引用UChar指针时未检查是否已越过匹配字符串的末尾，这导致了基于堆的缓冲区过度读取。 研究人员：ManhND（Tarantula团队，VinCSS，Vingroup成员） 什么是Oniguruma Oniguruma由K...

CVE-2026-38332

TinyEXIF before 1.1.0 is affected by a heap-based buffer over-read in the EntryParser::Fetch methods, triggered via a crafted SubjectArea length in EXIF data. The vulnerability carries a CVSS 3.1 score of 2.9 (LOW) with a local attack vector, high complexity, no privileges required, and a low ava...

CVE-2026-38332

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length...

CVE-2026-38332

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length...

CVE-2019-19204

CVE-2019-19204 Oniguruma 6.x の 6.9.4rc2 より前のバージョンに問題が見つかりました。regparse.c の関数 fetchintervalquantifier 旧称 fetchrangequantifier では、PEND を確認せずに PFETCH が呼び出されます。これにより、ヒープベースのバッファオーバーリードが発生します。 研究者: The Tarantula Team の ManhND、VinCSS Vingroup のメンバー Oniguruma とは K. Kosako による Oniguruma は、BSD...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

CVE-2025-15614

A flaw was found in ugrep. This vulnerability, a heap buffer over-read, occurs in the LZW decompressor when processing specially crafted .Z archive files. An attacker can provide a malicious .Z file, causing the decompressor to read beyond its allocated memory. This can lead to the application...

Linux Distros Unpatched Vulnerability : CVE-2025-15614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malform...

DEBIAN-CVE-2025-15614

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

CVE-2025-15614

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

UBUNTU-CVE-2025-15614

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

CVE-2025-15614

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

CVE-2025-15614 ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

CVE-2025-15614

ugrep before 7.6.0 is affected by a heap buffer over-read in its LZW decompressor (src/zopen.c) when processing crafted .Z archive files. The decompressor reads one byte past the allocated heap buffer , which can cause a process crash. The vulnerability requires a local attack vector and user int...

CVE-2025-15614 ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

EUVD-2025-210857

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

CVE-2025-15614

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...