PULSEUnderground Intel

EN VIVO6señales / 24h

FEED

ransomqilin reclama a Kayaku Safety Systems Malaysia Sdn Bhd · MY · Manufacturingransomscarlettgroup reclama a fittleworth.com · GB · Retail & E-Commerceransombarracuda reclama a FINSA · ES · Financial Servicesransomnetrunner reclama a F***** G****** C********** C*** · USransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomqilin reclama a Kayaku Safety Systems Malaysia Sdn Bhd · MY · Manufacturingransomscarlettgroup reclama a fittleworth.com · GB · Retail & E-Commerceransombarracuda reclama a FINSA · ES · Financial Servicesransomnetrunner reclama a F***** G****** C********** C*** · USransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerce

← Todos los CVEs

CVE Watch14 oct 2026

CVE-2022-1473

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash ta

CVSS

7.5

Alto

EPSS

4.7%

p92

KEV

—

Exploit Today

28

0-100

Publicado: 3 may 2022 · Última mod.: 14 oct 2026 · CWE-459

EPSS · 30d

4.6%EPSS · 30 días4.7%

2026-10-172026-11-13

Descripción técnica

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1283467.5 ALT

——15ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.2d CVE-2026-1269058.8 ALT

——7Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)2d CVE-2026-1268564.3 MED

——4Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)2d CVE-2026-1208065.5 MED

——5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.2d CVE-2026-1235607.5 ALT

——8Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.3d CVE-2026-1217503.1 BAJ

——1Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.4d