List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib vor 25.11.90 ignoriert SSL-Fehler für threatMatches:find in der Google Safe Browsing Lookup API auch Phishing-API genannt, was möglicherweise ... 2. CVE-2025-69413 - In Gitea vor 1.25.2 gibt /api/v1/user unterschiedliche Antworten für fehlgeschlagene...

CVE-2018-1000030

CVE-2018-1000030 Python 2.7.14 é vulnerável a um Heap-Buffer-Overflow, bem como a um Heap-Use-After-Free. Versões do Python anteriores à 2.7.14 também podem ser vulneráveis, e parece que o Python 2.7.17 e anteriores também podem ser vulneráveis, no entanto isso não foi confirmado ERRASANTHREADC18...

CVE-2020-9273

CVE-2020-9273 Dies sind die Dateien, die ich während der Analyse und Ausnutzung von CVE-2020-9273 erstellt habe – eine Heap Use-After-Free in ProFTPd. Sehen Sie sich das Exploit-Video hier an. Beschreibung der Dateien in diesem Repository: poc-not-really-v4.c – ein Artikel und poc, den ich letzte...

CVE-2026-45185

CVE-2026-45185 — Dead.Letter: Exim-Heap-UAF zu Remote-Root CVSS 9.8 Kritisch | Exim 4.97–4.99.2 | Ubuntu / GnuTLS-Builds | Ohne Authentifizierung Vollständiger Artikel mit GDB-Trace, Schritt-für-Schritt-Analyse und globalen Expositionsdaten:...

teamspeak3-vulnerabilities

TeamSpeak 3 Server – Proof-of-Concept-Exploits Dieses Repository enthält Proof-of-Concept-Code für drei Schwachstellen CVE-2026-4390, CVE-2026-4391 und CVE-2026-4392, die im TeamSpeak-3-Server 3.13.7 entdeckt wurden. Alle Ergebnisse wurden TeamSpeak verantwortungsvoll offengelegt und in unserem...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

CVE-2026-56848

CVE-2026-56848 NVD-Beschreibung Ein Fehler in der HTTP/2-Verarbeitung von Node.js ermöglicht es, nghttp2sessionmemsend reentrant aufzurufen, während nghttp2sessionmemrecv ausgeführt wird, was zu einem Heap-Use-after-Free führt. Diese Schwachstelle betrifft Node.js 26.x, 24.x und 22.x. Hinweis: Di...

BIT-NODE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF a...

SUSE CVE-2026-71847

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...

FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...

openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

SUSE-SU-2026:3557-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23130-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap use-after-free issues, Squid was vulnerable to Denial of Service attacks when handling ICP traffic. This vulnerability allowed a remote attacker to carry out a reliable and repeatable Denial of Service attack on the Squid...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a heap-use-after-free vulnerability in the MSL encoder, where a cloned image was destroyed twice. The MSL encoder does not support writing MSL, so the...

GHSA-9HJ4-R449-HFVC Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...