Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Feb 10, 2026A security vulnerability has been detected in ckolivas lrzip up to 0.651.CVE-2025-15571 · Other software · ckolivas · reported by VulDBLow 1.9
A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- lrzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A vulnerability was found in ckolivas lrzip up to 0.651.CVE-2025-15570 · Other software · ckolivas · reported by VulDBLow 1.9
A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- lrzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A security flaw has been discovered in ckolivas lrzip up to 0.651.CVE-2025-9396 · Other software · ckolivas · reported by VulDBLow 1.9
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Product
- lrzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 17, 2023lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.CVE-2023-39743 · Other software · Pete4abw · reported by MITREMedium 5.3
lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.
- Product
- Lzma Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 17, 2023lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp.CVE-2023-39741 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in lrzip version 0.641.CVE-2021-33453 · Other software · Long Range ZIP Project · reported by MITREHigh 7.8
An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in lrzip version 0.641.CVE-2021-33451 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 23, 2022Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp.CVE-2022-33067 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.CVE-2022-28044 · Other software · Irzip Project · reported by MITRECritical 9.8
Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.
- Product
- Irzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist().CVE-2022-26291 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 30, 2019The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (inCVE-2019-10654 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2018In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.CVE-2018-11496 · Other software · Long Range ZIP Project · reported by MITREMedium 6.5
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 2, 2018In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which allows remote attackers to cause a denial CVE-2018-10685 · Other software · Long Range ZIP Project · reported by MITRECritical 9.8
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 27, 2018In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c.CVE-2018-9058 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2018In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c).CVE-2018-5786 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 17, 2018In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c).CVE-2018-5747 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 12, 2018In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runzip.c.CVE-2018-5650 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 26, 2017In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers to cause a denial of service via a crafteCVE-2017-9929 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers to cause a denial of service via a crafted file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsomevulnsofadlab.blogspot.comgithub.com
Jun 26, 2017In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a craftedCVE-2017-9928 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafted file.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsomevulnsofadlab.blogspot.comgithub.com
May 8, 2017The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference anCVE-2017-8847 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
May 8, 2017The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) vCVE-2017-8846 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
May 8, 2017The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and aCVE-2017-8845 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
May 8, 2017The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application CVE-2017-8844 · Other software · Long Range ZIP Project · reported by MITREHigh 7.8
The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
May 8, 2017The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and applicatiCVE-2017-8843 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
May 8, 2017The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and apCVE-2017-8842 · Other software · Long Range ZIP Project · reported by MITREMedium 5.5
The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted archive.
- Product
- Long Range ZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gentoo.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.