CCS LAB CVE DISCOVERIES
Explore the catalog of vulnerabilities found by CCS LAB researchers. To access detailed information about each vulnerability, click on the respective CVE link.
| NO | DATE | CVE ID | CREDITS | NOTE |
| 68 | 2026/07/15 | CVE-2026-38974 | Yeonghyeon Choi, Duyeong Kim | Improper Verification of Cryptographic Signature in Dulwich |
| 67 | 2026/07/10 | CVE-2026-57575 | Yeonghyeon Choi, Duyeong Kim | Server-Side Request Forgery (SSRF) in misskey |
| 66 | 2026/07/06 | CVE-2026-38979 | Yeonghyeon Choi, Duyeong Kim | Improper Restriction of Rendered UI Layers or Frames in ajenti |
| 65 | 2026/07/06 | CVE-2026-38976 | Yeonghyeon Choi, Duyeong Kim | NULL Pointer Dereference in mrubyc |
| 64 | 2026/07/06 | CVE-2026-38973 | Yeonghyeon Choi, Duyeong Kim | Out-of-Bounds read in mrubyc |
| 63 | 2026/07/02 | CVE-2026-50722 | Yeonghyeon Choi, Duyeong Kim | Improper Verification of Cryptographic Signature in libreswan |
| 62 | 2026/07/02 | CVE-2026-50721 | Yeonghyeon Choi, Duyeong Kim | Improper Verification of Cryptographic Signature in libreswan |
| 61 | 2026/07/02 | CVE-2026-38972 | Yeonghyeon Choi, Duyeong Kim | Uncontrolled Search Path Element in Notepad3 |
| 60 | 2026/07/02 | CVE-2026-38971 | Yeonghyeon Choi, Duyeong Kim | Out-of-Bounds read in ArduPilot |
| 59 | 2026/07/02 | CVE-2026-38970 | Yeonghyeon Choi, Duyeong Kim | DoS (denial-of-service) in pdfcpu |
| 58 | 2026/07/02 | CVE-2026-38968 | Yeonghyeon Choi, Duyeong Kim | Possible Session Hijacking in ntopng |
| 57 | 2026/07/01 | CVE-2026-36912 | Yoonjong Na, Wonhong Jeong | Null pointer dereference in MPC-BE |
| 56 | 2026/07/01 | CVE-2026-36911 | Yoonjong Na, Wonhong Jeong | Division-by-zero in MPC-BE |
| 55 | 2026/07/01 | CVE-2026-36910 | Yoonjong Na, Wonhong Jeong | Denial of Service (DoS) in MPC-BE |
| 54 | 2026/07/01 | CVE-2026-36909 | Yoonjong Na, Wonhong Jeong | Null pointer dereference in MPC-BE |
| 53 | 2026/06/26 | CVE-2026-36908 | Yoonjong Na, Wonhong Jeong | Stack Overflow in MPC-BE |
| 52 | 2026/06/26 | CVE-2026-36907 | Yoonjong Na, Wonhong Jeong | Stack Overflow in MPC-BE |
| 51 | 2026/06/25 | CVE-2026-54096 | Yeonghyeon Choi, Duyeong Kim | Incorrect Authorization in filebrowser |
| 50 | 2026/06/02 | CVE-2026-38978 | Yeonghyeon Choi, Duyeong Kim | Improper Neutralization of CRLF Sequences in transmission |
| 49 | 2026/06/02 | CVE-2026-38967 | Yeonghyeon Choi, Duyeong Kim | Improper Neutralization of CRLF Sequences in HTTP Headers in CrowCpp |
| 48 | 2026/03/26 | CVE-2026-34352 | Yeonghyeon Choi, Duyeong Kim | Incorrect Permission Assignment for Critical Resource in tigervnc. |
| 47 | 2026/03/19 | CVE-2026-25667 | Choongin Lee, Isa Jafarov | DoS in Microsoft ASP.NET Core Kestrel HTTP/3 Server (Link) |
| 46 | 2025/11/07 | CVE-2025-26269 | Dongyeon Kim | DoS(Denial Of Service) in DragonflyDB |
| 45 | 2025/01/03 | CVE-2025-61684 | Choongin Lee, Isa Jafarov | DoS in Quicly-H2O Server (Link) |
| 44 | 2025/01/03 | CVE-2025-13834 | Choongin Lee | Remote Information Leak in Xiaomi Redmi Earbuds (CERT CC Report) |
| 43 | 2025/01/03 | CVE-2025-13328 | Choongin Lee | Remote DoS in Xiaomi Redmi Earbuds (CERT CC Report) |
| 42 | 2024/12/10 | CVE-2024-50931 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 41 | 2024/12/10 | CVE-2024-50930 | Nkuba Kayembe Carlos, Jimin Kang | Arbitrary code execution in Z-Wave chipsets |
| 40 | 2024/12/10 | CVE-2024-50929 | Nkuba Kayembe Carlos, Jimin Kang | Memory corruption in Z-Wave chipsets |
| 39 | 2024/12/10 | CVE-2024-50928 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 38 | 2024/12/10 | CVE-2024-50924 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 37 | 2024/12/10 | CVE-2024-50921 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 36 | 2024/12/10 | CVE-2024-50920 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 35 | 2024/02/09 | CVE-2024-25454 | Heewon Park, Choongin Lee | NULL pointer reference in Bento4 |
| 34 | 2024/02/09 | CVE-2024-25453 | Heewon Park, Choongin Lee | NULL pointer reference in Bento4 |
| 33 | 2024/02/09 | CVE-2024-25452 | Heewon Park, Choongin Lee | Out of memory bug in Bento4 |
| 32 | 2024/02/09 | CVE-2024-25451 | Heewon Park, Choongin Lee | Out of memory bug in Bento4 |
| 31 | 2024/02/09 | CVE-2024-25450 | Choongin Lee, Heewon Park | Mishandle memory allocation in imlib2 |
| 30 | 2024/02/09 | CVE-2024-25449 | Choongin Lee, Heewon Park | Double free in imlib2 |
| 29 | 2024/02/09 | CVE-2024-25448 | Choongin Lee, Heewon Park | Heap buffer overflow in imlib2 |
| 28 | 2024/02/09 | CVE-2024-25447 | Choongin Lee, Heewon Park | Heap buffer overflow in imlib2 |
| 27 | 2024/02/09 | CVE-2024-25446 | Heewon Park, Choongin Lee | Heap buffer overflow in HuginBase |
| 26 | 2024/02/09 | CVE-2024-25445 | Heewon Park, Choongin Lee | Improper handling of values in HuginBase |
| 25 | 2024/02/09 | CVE-2024-25444 | Heewon Park, Choongin Lee | NULL pointer defererence in HuginBase |
| 24 | 2024/02/09 | CVE-2024-25443 | Heewon Park, Choongin Lee | Heap-use-after-free in HuginBase |
| 23 | 2024/02/09 | CVE-2024-25442 | Heewon Park, Choongin Lee | Heap buffer overflow in HuginBase |
| 22 | 2023/12/08 | CVE-2023-6643 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 21 | 2023/12/08 | CVE-2023-6642 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 20 | 2023/12/08 | CVE-2023-6641 | Nkuba Kayembe Carlos, Jimin Kang | Insecure permissions in Z-Wave chipsets |
| 19 | 2023/12/08 | CVE-2023-6640 | Nkuba Kayembe Carlos, Jimin Kang | Crash in PC Controller v5.54.0 and earlier |
| 18 | 2023/12/05 | CVE-2023-6533 | Nkuba Kayembe Carlos, Jimin Kang | Uncaught Exception in PC Controller v5.54.0 and earlier |
| 17 | 2023/09/20 | CVE-2023-43622 | Choongin Lee, Isa Jafarov | DoS in Apache HTTP Server |
| 16 | 2023/07/10 | CVE-2023-37644 | Choongin Lee, Heewon Park | Heap Buffer overflow in SWFTools |
| 15 | 2022/08/15 | CVE-2022-38334 | Choongin Lee | Stack overflow in in XPDF v4.04 |
| 14 | 2022/08/15 | CVE-2022-38266 | Choongin Lee, Taewoo Kim | Arithmetic exception DoS in the Leptonica linked v1.79.0 |
| 13 | 2022/03/05 | CVE-2020-10137 | Nkuba Kayembe Carlos | DoS in Silicon Labs Z-Wave 700 series chipsets |
| 12 | 2022/02/18 | CVE-2020-9058 | Nkuba Kayembe Carlos | No encryption or replay protection in Silicon Labs Z-Wave 500 series chipsets |
| 11 | 2022/02/18 | CVE-2020-9057 | Nkuba Kayembe Carlos | Replay attack in Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets |
| 10 | 2021/08/02 | CVE-2021-37819 | Choongin Lee, Taewoo Kim | Infinite loop in pdftk-java v3.2.3 |
| 9 | 2021/07/21 | CVE-2021-37232 | Choongin Lee, Taewoo Kim | Stack overflow in Atomicparsley |
| 8 | 2021/07/21 | CVE-2021-37231 | Choongin Lee, Taewoo Kim | Stack-buffer-overflow in Atomicparsley |
| 7 | 2021/04/02 | CVE-2021-30046 | Choongin Lee | Segmentation fault vulnerability in VIGRA Computer Vision Library |
| 6 | 2020/12/14 | CVE-2020-35376 | Seunghoon Woo, Seongkyong Kwon | Incorrect subroutine reference in Xpdf |
| 5 | 2020/08/13 | CVE-2020-20412 | Seunghoon Woo, Seongkyong Kwon | Insufficient array bounds checking in libvorbis |
| 4 | 2020/06/15 | CVE-2020-14147 | Seunghoon Woo | Integer overflow in Redis |
| 3 | 2020/02/18 | CVE-2020-9061 | Nkuba Kayembe Carlos | DoS in Z-Wave devices using Silicon Labs 500 and 700 series chipsets |
| 2 | 2020/02/18 | CVE-2020-9060 | Nkuba Kayembe Carlos | Dos in Z-Wave devices based on Silicon Labs 500 series chipsets using S2 Encryption |
| 1 | 2020/02/18 | CVE-2020-9059 | Nkuba Kayembe Carlos | Uncontrolled resource consumptionin in Silicon Labs Z-Wave 500 series chipsets |