List-CVE-2025-2026

CVE-2025-69412 - O KDE messagelib anterior à versão 25.11.90 ignora erros SSL para threatMatches:find na API Google Safe Browsing Lookup também conhecida como API de phishing, o que pode permitir ... 2. CVE-2025-69413 - No Gitea anterior à versão 1.25.2, /api/v1/user tem respostas diferentes...

CVE-2026-56848

CVE-2026-56848 NVD-Beschreibung Ein Fehler in der HTTP/2-Verarbeitung von Node.js ermöglicht es, nghttp2sessionmemsend reentrant aufzurufen, während nghttp2sessionmemrecv ausgeführt wird, was zu einem Heap-Use-after-Free führt. Diese Schwachstelle betrifft Node.js 26.x, 24.x und 22.x. Hinweis: Di...

CVE-2026-45185

CVE-2026-45185 — Dead.Letter: UAF sull'heap di Exim fino a root remota CVSS 9.8 Critico | Exim 4.97–4.99.2 | Build Ubuntu / GnuTLS | Non autenticato Analisi completa con trace GDB, analisi passo-passo e dati sull'esposizione globale: https://0init.github.io/cve-2026-45185-dead-letter-exim-rce.htm...

CVE-2020-9273

CVE-2020-9273 Dies sind die Dateien, die ich während der Analyse und Ausnutzung von CVE-2020-9273 erstellt habe – eine Heap Use-After-Free in ProFTPd. Sehen Sie sich das Exploit-Video hier an. Beschreibung der Dateien in diesem Repository: poc-not-really-v4.c – ein Artikel und poc, den ich letzte...

CVE-2018-1000030

CVE-2018-1000030 Python 2.7.14 è vulnerabile a un Heap-Buffer-Overflow così come a un Heap-Use-After-Free. Anche versioni di Python precedenti alla 2.7.14 potrebbero essere vulnerabili e sembra che Python 2.7.17 e precedenti possano essere vulnerabili, ma ciò non è stato confermato ERRASANTHREADC...

teamspeak3-vulnerabilities

TeamSpeak 3 Server - Proof of Concept degli Exploit Questo repository contiene codice proof of concept per tre vulnerabilità CVE-2026-4390, CVE-2026-4391 e CVE-2026-4392 scoperte nel server TeamSpeak 3 3.13.7. Tutti i risultati sono stati divulgati responsabilmente a TeamSpeak e pubblicati nel...

FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

RHEL 7 : openssl (RHSA-2026:58563)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58563 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Exploit for CVE-2026-56848

CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2...

BIT-NODE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

PT-2026-73396

A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF a...

SUSE CVE-2026-71847

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...

K000162917: Node.JS vulnerability CVE-2026-56848

Security Advisory Description A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-56848 Impact There is no impact; F...

FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...

openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

SUSE-SU-2026:3557-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...