Cet article présente une analyse technique complète de CVE-2026-94127, une vulnérabilité de type heap overflow non authentifié affectant F5 BIG-IP APM, activement exploitée dans la nature au moment de la publication.

TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researchers say it even carries its own ASLR bypass, which raises the odds of remote code execution. F5 patched it on July 15, 2026. Why This NGINX Heap Overflow Matters The flaw needs no login and no user interaction.

TL;DR Researchers publicly disclosed a libssh2 vulnerability tracked as CVE-2026-58050. The flaw lets a malicious SSH server corrupt the heap of a connecting client. Proof-of-concept exploit code is already public, and the bug scores 8.3 under CVSS v4. Why It Matters libssh2 powers SSH inside many tools, libraries, and embedded devices. It ships in file transfer clients, automation frameworks, and language bindings.

A missing bounds check in binutils' FR30 relocation handler lets a single crafted object file turn objdump -g into a one-shot exploit chain — defeating ASLR, PIE and modern heap hardening with no information leak. The Calif team's writeup walks through wrapping a 64-bit arelent offset, swapping endianness via a 2-byte partial overwrite of an xvec pointer, borrowing i386's partial_inplace relocation as an OOB increment, and finally pivoting to code execution through a House of Apple 2 FILE-struct hijack.

TL;DR Two VLC media player vulnerabilities let attackers corrupt or read heap memory. One triggers on a crafted PNG file. The other triggers when VLC connects to a malicious RTSP server. No patch is available yet. Why these VLC media player vulnerabilities matter VLC ships on hundreds of millions of desktops worldwide. A single booby-trapped file could reach that huge install base.

TL;DR PostgreSQL patched a heap buffer overflow tracked as CVE-2026-14669 on August 13, 2026. This PostgreSQL vulnerability scores a CVSS of 8.8 and can lead to remote code execution. Full technical details and proof-of-concept exploit code are now public. Why it matters PostgreSQL runs behind countless web apps and services. An authenticated user can abuse this flaw to run code as the database operating system account.

Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill - it’s the typical enterpri...

TL;DR Four new libssh2 vulnerabilities put SSH and SFTP clients at risk. Each one lets a malicious SSH server corrupt memory on the machine that connects to it. VulnCheck disclosed the flaws on July 24, 2026, and upstream fixes are ready. Why it matters libssh2 sits inside countless tools that speak SSH. It ships with package managers, Git clients, and many programming libraries.

TL;DR A researcher published full technical details and working proof-of-concept exploit code for a Knot Resolver RCE bug. The heap out-of-bounds write sits in the DNS-over-QUIC listener and needs no authentication. CZ.NIC shipped the fix a day earlier in version 6.4.1. Why it matters Knot Resolver is CZ.NIC's open-source caching recursive resolver. Large ISPs run it in front of very large subscriber bases.

CVE-2026-15028 reveals a heap overflow vulnerability in Libarchive, which increases the risk of service disruption and unauthorized access.

TL;DR RARLAB fixed a WinRAR vulnerability in version 7.23. The flaw, CVE-2026-14191, causes a heap overflow in the RAR5 recovery-volume parser. It affects WinRAR, RAR, and UnRAR. No exploitation in the wild has been confirmed. Why It Matters WinRAR ships on hundreds of millions of PCs. So its flaws draw attacker interest fast. In fact, other WinRAR bugs saw active abuse during 2025.