Published CVEs

CWE-420 — ControlMaster ask mux-proxy confirmation bypass (fixed in OpenSSH 10.3p1)

Sole discovery

GP cert auto-enrollment plain-HTTP root-CA injection (all Samba >= 4.16)

Additional reporter (w/ DREAM Team)

Integer-overflow range-check bypass leads to OOB read in HEIF decoder (ships in KDE/Qt/ImageMagick)

Sole reporter

Unauthenticated Spotlight-RPC heap OOB read via unbounded element count in sl_unpack_ints

Sole reporter

Unauthenticated Spotlight-RPC heap OOB read via unbounded toc_index in sl_unpack_loop

Sole reporter

afp_catsearch in-arena heap over-read

Sole reporter

Missing range validation on server quantum config leads to DoS

Sole reporter

BINUNICODE heap overflow in .ckpt pickle parser

Sole reporter

Out-of-bounds reads in pickle parser

Sole reporter

SHORT_BINUNICODE heap overflow

Sole reporter

GLOBAL opcode heap overflow

Sole reporter