CVE-2020-0674

CVE-2020-0674 CVE-2020-0674 是传统 jscript 引擎中的一个释放后使用漏洞。可在 Internet Explorer 中触发。此处的利用代码由 maxpl0it 编写，但漏洞本身由 Qihoo 360 发现，且已在野外被利用。该利用仅用于弹出计算器。 可在此处找到利用分析文章。 漏洞概述 该漏洞存在于使用比较函数时的 Array sort 方法中。 比较函数的两个传入参数未被垃圾回收器追踪，因此在垃圾回收被调用后，它们将指向已释放的内存。 利用说明 该利用代码专门针对 Windows 7 编写，但可能无需太多麻烦即可移植。 该利用代码针对 x64 版本的 ...

uaf-2023-28205

CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability can be exploited through maliciously crafted web content, allowing attackers to execute arbitrary code. Description The code triggers a use-after-free UAF vulnerability by delaying the addition of Map and Date objects,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: clone set element expression template The memcpy function breaks when using connlimit in set elements. Use nftexprclone to initialize the connlimit expression list; otherwise, the connlimit garbage collect...

Astra Linux – Vulnerability in Firefox, Thunderbird

Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” 全球最快内存存储中的严重远程代码执行漏洞 Redis Lua 脚本执行区域现已成为认证后的完美着陆点。 经过认证的攻击者 → 精心构造的 Lua 脚本 → 逃逸沙箱 → 在宿主机上实现完全 RCE ⚠️ 概述 CVE-2025-49844 （“RediShell ”）是 Redis 嵌入式 Lua 脚本引擎中一个严重的释放后使用（UAF）内存破坏漏洞 。 一个经过认证的 用户通过 EVAL/EVALSHA 提交一个精心构造的 Lua 脚本，该脚本操纵垃圾收集器，在解析/执行过程中触发 UAF，逃逸 Lua...

bad_garbage

BADGARBAGE.c CVE-2026-53361 —— AFUNIX 套接字垃圾回收器中的一个无特权、可实现容器逃逸的释放后使用漏洞。这是单向量（仅 MSGPEEK）版本。 漏洞 AFUNIX 垃圾回收器会回收形成不可达引用循环的“在途”套接字。当并发的 MSGPEEK 作用于在途 fd 时，会取得一个 GC 普查（census）从未计数的引用，因此回收器可能释放一个仍存活套接字并留下悬空 skbuff。peek 本应在回收运行时退避，但它所检查的 gcinprogress 标志可能在运行中途读到 false，于是 peek 穿过检查，竞态由此敞开。 同一交互，已修复三次：...

CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

Redis < 6.2.20 / 7.0.x < 7.2.11 / 7.4.x < 7.4.6 / 8.0.x < 8.0.4 / 8.2.x < 8.2.2 RCE (RediShell)

The version of Redis installed on the remote host is prior to 6.2.20, 7.0.x prior to 7.2.11, 7.4.x prior to 7.4.6, 8.0.x prior to 8.0.4, or 8.2.x prior to 8.2.2. It is, therefore, affected by a vulnerability as referenced in the security advisory. - A use-after-free vulnerability in the Lua...

Astra Linux – Vulnerability in Firefox

Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...

Astra Linux – Vulnerability in Firefox

If array shift operations are not used, the Garbage Collector may become confused regarding valid objects. This vulnerability affects Firefox versions less than 101...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 GA retains the legacy AFUNIX garbage collector, but the upstream commit 8594d9b85c07 "afunix: Do not call skbget for OOB skb" addresses this issue. When orphaned MSGOOB sockets reach unixgc, the garbage collector still calls kfreeskb, assuming that OOB SKBs hold two references...

Astra Linux – Vulnerability in Firefox and Thunderbird

Certain types of allocations lacked annotations that, if the Garbage Collector was in a specific state, could have led to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...

UBUNTU-CVE-2026-74937

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-66686

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66686

Summary: CVE-2026-66686 is an Unauthenticated CSRF vulnerability in the WordPress plugin Plugins Garbage Collector (Database Cleanup) , affecting versions ≤ 0.14. The vulnerability is described as unauthenticated CSRF, implying an attacker could induce actions on behalf of a user without requirin...

CVE-2026-66686 WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

EUVD-2026-53897

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

OESA-2026-3213 mozjs102 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a...

OESA-2026-3214 mozjs102 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a...