Loading story…
Two high-severity vulnerabilities, CVE-2026-4750 and CVE-2026-4753, were disclosed for the open-source projects fabiangreffrath woof and slajerek RetroDebugger. Both issues are classified as CWE-125 out-of-bounds read flaws and carry the same CVSS v3.1 score vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, indicating low-complexity, no-authentication exploitation with high impact on confidentiality and availability.
The Woof flaw affects versions before woof_15.3.0, while the RetroDebugger issue affects versions before v0.64.72. Each CVE entry also points to a related GitHub pull request tied to remediation or discussion, including PR #97 for RetroDebugger, signaling that fixes or code changes have been tracked publicly. Organizations using either project should identify exposed deployments and prioritize upgrades to patched versions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-4753, was received on 2026-03-24 for an out-of-bounds read vulnerability in slajerek RetroDebugger affecting versions before v0.64.72. The issue was classified as CWE-125 and assigned a high-severity CVSS v3.1 vector, with a GitHub pull request reference linked to the record.
A new CVE entry, CVE-2026-4750, was received on 2026-03-24 for an out-of-bounds read vulnerability in fabiangreffrath woof affecting versions before 15.3.0. The flaw was classified as CWE-125 and assigned a high-severity CVSS v3.1 score indicating network-reachable impact on confidentiality and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity memory-corruption vulnerabilities were disclosed in widely used TLS-related software components. **CVE-2026-5264** affects wolfSSL and stems from DTLS 1.3 ACK message processing, where a remote attacker can send a crafted ACK packet to trigger a heap buffer overflow. The flaw is classified as `CWE-122` and is network-reachable with low attack complexity and no privileges or user interaction required, raising concern for applications that expose DTLS 1.3 services. A separate flaw, **CVE-2026-5402**, was disclosed in Wireshark’s TLS protocol dissector and affects versions `4.6.0` through `4.6.4`. The vulnerability is also a heap-based buffer overflow (`CWE-122`) and could allow denial of service and possible code execution when malicious traffic is processed, with the CVSS vector indicating high impact to confidentiality, integrity, and availability. Public references point to a wolfSSL GitHub pull request for the DTLS issue and to a GitLab issue and official Wireshark security advisory for the dissector flaw.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **Gotenberg**, the document-conversion API, affecting separate parts of the product’s request-handling logic. **`CVE-2026-27018`** allows a deny-list bypass in Chromium-based processing because protections added for **`CVE-2024-21527`** can be evaded with mixed-case or uppercase URL schemes, creating exposure associated with **`CWE-22`** and **`CWE-918`**. The flaw is remotely reachable with low attack complexity and requires no privileges or user interaction, according to the published CVSS v4 metadata. A second issue, **`CVE-2026-35458`**, affects **Gotenberg 8.29.1 and earlier** and can be exploited for **regular expression denial of service** through the `extraHttpHeaders` scope feature. User-supplied scope patterns are compiled with **`dlclark/regexp2`** without an adequate timeout, allowing authorized users of the affected feature to hang workers indefinitely and degrade service availability. The SSRF-related bypass was patched in **Gotenberg 8.29.0**, while the ReDoS issue highlights an additional availability risk for deployments that expose header-scoping functionality.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026