Skip to content
Threat Feed
Subscribe

Vendor

OpenSSL

9 briefs RSS
critical threat

CVE-2026-63030: Critical Remote Code Execution Vulnerability in WordPress Core

CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability affecting WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, allowing an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint, potentially leading to complete website compromise.

exploited PoC WordPress Core 6.9.0 +51 wordpress rce web-vulnerability cve
2t 15c 8i updated
medium advisory

Hitachi Energy GMS600 Vulnerable to Bleichenbacher Attack via CVE-2022-4304

Hitachi Energy GMS600 versions 1.3.0 and 1.3.1 are affected by CVE-2022-4304, a vulnerability in the OpenSSL RSA Decryption implementation; an attacker could exploit this timing-based side channel to recover plaintext across a network in a Bleichenbacher-style attack by sending trial messages to the server and recording processing times, eventually decrypting application data.

GMS600 versions 1.3.0 and 1.3.1 bleichenbacher timing attack openssl critical infrastructure
2r 1t 1c
medium advisory

Multiple Vulnerabilities in OpenSSL Allow for DoS, Information Disclosure, and Ciphertext Recovery

Multiple vulnerabilities in OpenSSL can be exploited by a remote attacker to conduct a denial-of-service attack, disclose information, or recover ciphertext over a network.

OpenSSL vulnerability denial-of-service information-disclosure ciphertext-recovery
2r 2t
medium advisory

OpenSSL Vulnerability Allows Denial of Service and Information Disclosure

A remote, authenticated attacker can exploit a vulnerability in OpenSSL to perform a denial-of-service attack and disclose information.

OpenSSL denial-of-service information-disclosure
2r 2t
high advisory

rust-openssl AES Key Wrap Out-of-Bounds Write Vulnerability

The rust-openssl package is vulnerable to an out-of-bounds write due to an incorrect bounds assertion in the `aes::unwrap_key()` function, potentially leading to arbitrary code execution if attacker-controlled buffer sizes are permitted.

openssl aes keywrap oob-write memory-corruption
2r
medium advisory

OpenSSL Data Encryption Detection

This brief documents detection of OpenSSL being used to encrypt data using command-line arguments specifying input and output files, potentially indicating data exfiltration preparation or ransomware activity by threat actors.

OpenSSL defense-evasion collection data-encryption
2r 2t
high advisory

rust-openssl X509Ref::ocsp_responders Undefined Behavior Vulnerability

The `X509Ref::ocsp_responders` function in rust-openssl versions 0.9.7 to 0.10.78 returns OCSP responder URLs from a certificate's AIA extension without proper UTF-8 validation, leading to undefined behavior when processing certificates with non-UTF-8 OCSP URLs.

openssl vulnerability rust certificate
2r 1t
high advisory

rust-openssl Stack Buffer Overflow Vulnerability

The rust-openssl crate is vulnerable to a stack-based buffer overflow (CVE-2026-41681) where the `EVP_DigestFinal()` function writes beyond the allocated buffer, potentially corrupting the stack, affecting versions >= 0.10.39 and < 0.10.78.

openssl buffer overflow rust vulnerability
2r
high advisory

Heap/Stack Overflow in rust-openssl with OpenSSL 1.1.x

The rust-openssl crate's `Deriver::derive` and `PkeyCtxRef::derive` functions can cause heap/stack overflows when used with OpenSSL 1.1.x due to insufficient buffer length validation in X25519, X448, DH, and HKDF-extract, affecting rust-openssl versions >= 0.9.27 and < 0.10.78.

openssl buffer-overflow rust cryptography
2r