CVE-2026-91963

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91946

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...

CVE-2025-14177

CVE-2025-14177 — PHP getimagesize 堆内存泄漏 仅限授权的渗透测试和安全研究使用。 漏洞 字段| 值 ---|--- CVE| CVE-2025-14177 CWE| CWE-524 使用未初始化的资源 严重性| 中危 — CVSS 6.3 根本原因| phpreadstreamallchunks 将连续的数据块写入 buffer0，覆盖之前的数据，导致未初始化的堆内存泄漏 受影响版本 PHP 8.1.34 PHP 8.2.30 PHP 8.3.29 PHP 8.4.16 PHP 8.5.1 修复版本 PHP 8.1.34 / 8.2.30 / 8.3.2...

CVE-2025-14847-mongobleed

CVE-2025-14847-mongobleed CVE-2025-14847 mongobleed python file CVE-2025-14847 CVE-2025-14847 https://jira.mongodb.org/browse/SERVER-115508 SUMMARY This is a critical fix to address CVE-2025-14847. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. ISSUE DESCRIPTION AND IMPACT An...

CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

Astra Linux – Vulnerability in Apache2

The out-of-bounds write vulnerability in the modsed module of the Apache HTTP Server allows an attacker to overwrite heap memory with data provided by the attacker. This issue affects Apache HTTP Server version 2.4.2.52 and earlier versions...

Astra Linux – Vulnerability in Vim

Vim is an open-source command-line text editor. From version 9.2.0320 to 9.2.0679, a crafted undo or swap file could store a virtual-text property whose offset and length points outside the line’s property data. When Vim restores or displays such a line, it converts the offset into a pointer and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: The trailing padding bytes after the u8 hard field in struct xfrmuserexpire are cleared during the buildpolexpire function. However, the analogous function buildexpire does not perform the same operation for struct...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor SAUCE patches that may potentially incorrectly calculate the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. This bug can be triggered by an unprivileged local user, and it can result in invali...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11378)

Summary IBM MQ has addressed an integer overflow vulnerability in the queue manager's object descriptor conversion that could allow a remote authenticated attacker to write zeros to arbitrary heap memory locations, leading to remote code execution. Vulnerability Details CVEID:CVE-2026-11378...

CVE-2026-15892

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2025-14847

CVE-2025-14847 描述 CVE-2025–14847，也称为MongoBleed，是一个允许攻击者在无需身份验证的情况下从运行MongoDB数据库的服务器的堆内存空间中执行未授权数据读取的漏洞。 复现步骤 root@kitploit: podman-compose vuln-machine/ up -d 利用方法 root@kitploit: python3 -m venv venv && source venv/bin/activate python3 exploit.py 参考 修复提交 免责声明...

CVE-2025-14847

🚨 CVE-2025-14847 — “MongoBleed” 一个高危的未认证内存泄露漏洞 📖 目录 概述 技术细节 严重性与CVSS评分 受影响版本 真实影响 利用概要 检测指南 修复措施 临时缓解措施 安全清单 总结 🔎 概述 CVE-2025-14847 ，绰号 “MongoBleed” ，是MongoDB服务器网络协议处理中的一个漏洞。 它允许远程、未认证的攻击者 从易受攻击的MongoDB进程中读取未初始化的堆内存 。 这可能导致敏感信息泄露，例如： 🔑 凭据 🔐 加密密钥 🎟 会话令牌 📦 内部运行时数据 🧠 技术细节 🧩 根本原因 问题源于： zlib压缩协议头部...

DirtyCred

DirtyCred: Escalando Privilegios en el Kernel de Linux DirtyCred es un concepto de explotación del kernel que intercambia credenciales del kernel no privilegiadas por privilegiadas para escalar privilegios. En lugar de sobrescribir campos de datos críticos en el heap del kernel, DirtyCred abusa d...

CVE-2022-2274

OpenSSL-src 在 RSA 私钥操作时发生堆内存损坏：CVE-2022-2274 摘要 OpenSSL-src-rust 是一个使用 Rust 编写的、以 crate 形式打包的 OpenSSL 源码和从源码构建 OpenSSL 的逻辑。目前有两个受维护的分支，分别对应两个受维护的 OpenSSL 版本，即构建 OpenSSL 3.0 的 main 分支和构建 OpenSSL 1.1.1 的 release/111 分支。 OpenSSL 3.0.4 版本在为支持 AVX512IFMA 指令的 X8664 CPU 实现的 RSA 代码中引入了一个严重缺陷。该问题使得 2048...

CVE-2025-50422

Poppler 25.04.0 版本之前 当 pdftocairo 渲染恶意 PDF 并在退出时调用 cairodebugresetstaticdata 时，包含 PDF 对象流的堆内存未被正确清除。具有本地访问权限的攻击者可以转储进程内存并恢复明文 PDF 内容（例如 /stream /endstream 块）。 具体的漏洞复现过程（漏洞原因.pdf）和 POC 文件（poppler-pdftocairo-poc）已附上。 供应商（freedesktop，Poppler 的维护者）已确认此问题并修复了该漏洞。修复程序已提交到其官方代码库。 以下是供应商提供的补丁/提交的公开链接：...

MongoBLEED---CVE-2025-14847-POC-

MongoBLEED---CVE-2025-14847-POC- 此仓库包含我的 CVE-2025-14847 MongoBleed 的 Python 脚本版本。 描述 该脚本通过发送伪造的解压缩大小字段来模拟恶意请求。如果服务器存在漏洞，它将返回堆内存中的相邻数据。 前提条件 Python 3.x 能够通过网络访问目标主机的 27017 端口。 使用方法 编辑脚本顶部的 HOST、PORT 和 SIZE 变量，或通过命令行执行（如果已实现）。 在您的 IDE 中运行脚本 此脚本是一个概念验证（PoC），用于通过 OPCOMPRESSED 数据包诊断 MongoDB 实例中的堆内存泄漏漏...

PT-2026-90984

The mcumgr SMP settings-management group handlers settings mgmt read, settings mgmt write, and settings mgmt delete in subsys/mgmt/mcumgr/grp/settings mgmt/src/settings mgmt.c allocate a key name buffer and, for read, a data buffer via k malloc when CONFIG MCUMGR GRP SETTINGS BUFFER TYPE HEAP is...