LIVE · cybersecurity feed
Live wire
OpenAI Announced $1B in Defensive Tools for Water UtilitiesAttackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsCVE-2026-59346 · Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host CodeCVE-2026-32475 · Elementor Pro WordPress Plugin Vulnerability Exploited to Hack SitesBroadcom Patches Critical VMware Workstation and Fusion VM-Escape VulnerabilitiesHackers Leak Millions of Airport Passenger Records After Ransom RefusalUsing a VM to Contain an AI AgentCVE-2026-73749 · HPE Patches Critical RCE Vulnerabilities in AOS-CXCompanies Have Six Months to Prepare for Automated AttacksPhishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
vendor

Openssl

11 CVEs published in the last four months and 5 stories. Exploited flaws first.

Critical1
High9
Medium1
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-341829.1criticalopensslIssue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the88d ago
CVE-2026-454478.8highopensslIssue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 si88d ago
CVE-2026-73838.1highopensslIssue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_nco88d ago
CVE-2026-427647.5highopensslIssue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the88d ago
CVE-2026-427657.5highopensslIssue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for t88d ago
CVE-2026-454457.5highopensslIssue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, t88d ago
CVE-2026-90767.5highopensslIssue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data88d ago
CVE-2026-341807.5highopensslIssue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 giga88d ago
CVE-2026-341837.5highopensslIssue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets contai88d ago
CVE-2026-341817.4highopensslIssue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Passwor88d ago
CVE-2026-26736.5mediumopensslIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its k176d ago

Filter the full tracker by Openssl →

Our coverage of Openssl

trend microhigh

ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been discovered in Trend Micro VPN's OpenSSL configuration. Attackers with low-privileged code execution can exploit this by leveraging an unsecured configuration file location to escalate privileges and run arbitrary code as SYSTEM. Trend Micro has released an update to address this issue.

vulnerability

OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability

Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability appeared first on SecurityWeek.

opensslhigh

OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload

Okta's Red Team has identified a denial-of-service vulnerability in OpenSSL named HollowByte. A remote, unauthenticated attacker can exploit this flaw using an 11-byte payload to trigger excessive memory allocation on the server before the TLS handshake completes, leading to a denial of service. The vulnerability stems from OpenSSL's trust in the declared message size, which allows for large memory allocations based on untrusted input, and the issue is compounded by heap fragmentation preventing memory reuse.

openssl

OpenSSL Flaw Allows Denial-of-Service via Small TLS Requests

A denial-of-service vulnerability in OpenSSL, dubbed HollowByte, can be triggered by sending an 11-byte TLS request. This request causes unpatched servers, particularly those using glibc, to allocate up to 131 KB of memory that remains unavailable until the server process is restarted. The fix was released in June without specific disclosure.

opensslhigh

HollowByte DDoS flaw bloats OpenSSL server memory

A vulnerability named HollowByte has been discovered that enables unauthenticated attackers to cause a denial-of-service on OpenSSL servers. The attack requires only a small, 11-byte malicious payload to trigger the condition, which reportedly causes server memory to bloat.