CVE-2026-58051
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so
CVSS
6.5
Medio
EPSS
0.3%
p20
KEV
—
Exploit Today
6
0-100
Publicado: 28 jun 2026 · Última mod.: 30 jun 2026 · CWE-908
0.3%EPSS · 30 días0.3%
2026-06-302026-07-21
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-600058.2 ALT45.3%
——14NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
Impact:
This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.6dCVE-2026-585466.5 MED39.8%
——12Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.5dCVE-2026-585356.5 MED55.3%
——17Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.7dCVE-2026-585336.5 MED55.3%
——17Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.7dCVE-2026-579826.5 MED57.5%
——17Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.1dCVE-2026-570845.5 MED40.7%
——12Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.4d