codeanlabs

CVE-2025-47934 allows attackers to spoof arbitrary signatures and encrypted emails that appear as valid in OpenPGP.js. The only requirement is access to a single valid signed message from the target author ("Alice"). Since this undermines the core princip

CVE-2025-32464 is a vulnerability in HAProxy 2.2 up to 3.1.6-d929ca2 which allows an attacker to perform a DoS attack exploiting specific usages of the regsub converter. It cause a heap buffer overflow, making the whole HAProxy pool of workers crash. Give

Attackers can write semi-arbitrary files in the filesystem, and remotely extract values from environment variables and from INI-like files in the filesystem via two vulnerabilities in LibreOffice. Both occur upon loading the document, without any user int

During our research into Ghostscript, we also identified five memory-corruption-related vulnerabilities (CVE-2024-29506, CVE-2024-29507, CVE-2024-29508, and CVE-2024-29509). This blog post describes all the remaining bugs from our research which we did no

An arbitrary file read/write vulnerability in Ghostscript 10.02.1 which enables attackers to read/write arbitrary files on the complete filesystem including outside of the -dSAFER sandbox. CVE-2024-29511 has significant impact on web-applications and othe

A format string vulnerability in Ghostscript 10.03.0 which enables attackers to gain Remote Code Execution (#RCE) while also bypassing sandbox protections. CVE-2024-29510 has significant impact on web-applications and other services offering document conv

A vulnerability in PDF.js found by Codean Labs. PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This bug allows an attacker to execute arbitrary JavaScript code as soon as a malicious PDF file is opened. This affects all Firefox users (

Vulnerabilities emerge if software developers rely too much on the security of external components like open source libraries. A customer project led us into a rabbit hole finding multiple issues in third-party packages, resulting in critical vulnerabilit

A deep dive on the security of a connected IoT thermostat and how a useful feature that is simply part of the product can fully undermines the network security when deployed.