LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Openssl

11 CVEs published in the last four months and 5 stories. Exploited flaws first.

Critical1
High9
Medium1
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-341829.1criticalopensslIssue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the136d ago
CVE-2026-454478.8highopensslIssue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 si136d ago
CVE-2026-73838.1highopensslIssue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_nco136d ago
CVE-2026-427647.5highopensslIssue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the136d ago
CVE-2026-427657.5highopensslIssue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for t136d ago
CVE-2026-454457.5highopensslIssue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, t136d ago
CVE-2026-90767.5highopensslIssue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data136d ago
CVE-2026-341807.5highopensslIssue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 giga136d ago
CVE-2026-341837.5highopensslIssue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets contai136d ago
CVE-2026-341817.4highopensslIssue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Passwor136d ago
CVE-2026-26736.5mediumopensslIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its k224d ago

Filter the full tracker by Openssl →

Our coverage of Openssl

trend microhigh

ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Trend Micro's TrendLife VPN product has been found to contain a local privilege escalation vulnerability, tracked as CVE-2026-67212, which could allow an attacker to execute arbitrary code with SYSTEM privileges. The flaw, identified as ZDI-26-577 (ZDI-CAN-29830), stems from an uncontrolled search path element in the OpenSSL configuration used by the VPN client.

vulnerability

OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability

A denial-of-service (DoS) vulnerability, dubbed "HollowByte," has reportedly been addressed in OpenSSL. The flaw could allow attackers to exhaust server memory by sending specially crafted payloads that trigger buffer pre-allocations which are not subsequently freed. The fix was implemented silently, indicating a patch was released without a public security advisory detailing the vulnerability…

opensslhigh

OpenSSL Vulnerability Allows Memory Exhaustion via 11-Byte Payload

A denial-of-service vulnerability, dubbed "HollowByte," has been discovered in OpenSSL that allows remote, unauthenticated attackers to exhaust server memory and trigger denial-of-service attacks using a specially crafted 11-byte payload. The flaw was disclosed by Okta's Red Team on July 18, 2026.

openssl

OpenSSL Flaw Allows Denial-of-Service via Small TLS Requests

A denial-of-service vulnerability has been identified in OpenSSL, allowing attackers to disrupt service by sending small TLS requests. The flaw, internally dubbed "HollowByte," can be triggered with an 11-byte TLS request, leading to significant memory allocation issues on vulnerable servers.

opensslhigh

HollowByte DDoS flaw bloats OpenSSL server memory

A denial-of-service vulnerability, dubbed HollowByte, has been identified in OpenSSL, allowing unauthenticated attackers to deplete server memory with minimal data transmission. The OpenSSL team has addressed the flaw in recent updates, though no CVE identifier has been assigned. Organizations are strongly advised to update their OpenSSL installations to a patched version.