Use-after-free
19 news stories · 18 news CVEs · 2 newly listed by CISA. 18 distinct CVEs in total; the two sources can overlap.
Learn this
Turn the weaknesses behind security news into something you can understand and practise. Start with a topic, explore a lab or course, then read how developers prevent it.
In the last seven days
News covers the last seven days. CISA additions cover seven calendar dates, including today in Dubai. Ordered by grouped news stories, then newly listed CISA flaws. This is a learning guide, not a risk ranking.
82 of 137 distinct CVEs have a reviewed learning match. Others may have labels still to collect, no specific label, or a weakness we have not matched.
Authorization weaknesses
18 news stories · 18 news CVEs · 0 newly listed by CISA. 18 distinct CVEs in total; the two sources can overlap.
Uninitialized data
10 news stories · 10 news CVEs · 0 newly listed by CISA. 10 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Race conditions
9 news stories · 9 news CVEs · 0 newly listed by CISA. 9 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Out-of-bounds write
8 news stories · 5 news CVEs · 2 newly listed by CISA. 6 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Heap buffer overflow
5 news stories · 5 news CVEs · 0 newly listed by CISA. 5 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Type confusion
5 news stories · 5 news CVEs · 0 newly listed by CISA. 5 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Authentication weaknesses
3 news stories · 3 news CVEs · 0 newly listed by CISA. 3 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Integer overflow or underflow
2 news stories · 2 news CVEs · 0 newly listed by CISA. 2 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Missing authentication
2 news stories · 2 news CVEs · 0 newly listed by CISA. 2 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
OS command injection
2 news stories · 2 news CVEs · 0 newly listed by CISA. 2 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Stack buffer overflow
2 news stories · 2 news CVEs · 0 newly listed by CISA. 2 distinct CVEs in total; the two sources can overlap.
See the CVEs and their source labels
Unsafe file uploads
0 news stories · 0 news CVEs · 1 newly listed by CISA. 1 distinct CVE in total; the two sources can overlap.
See the CVEs and their source labels
All learning topics
Resources teach a weakness class, not an exploit for a specific CVE. Use the affected product’s vendor advice for fixes. A CWE is an identifier for a type of weakness.
Authentication weaknesses
The application does not reliably check that someone is who they claim to be.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-287
Authorization weaknesses
The application fails to check whether this user may access a resource or perform an action.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Cross-site request forgery
A site tricks a signed-in browser into sending an unwanted action to another site.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-352
Cross-site scripting
Untrusted content becomes code running in another visitor's browser.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-79
HTTP request smuggling
Servers disagree about where a request ends, letting a request be interpreted unexpectedly.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-444
Heap buffer overflow
A write runs past allocated heap storage and can damage neighbouring data.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Matched labels: CWE-122
Insecure deserialization
Rebuilding objects from untrusted saved data can trigger unintended behaviour.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-502
Integer conversion errors
Changing a number's size or signedness changes its meaning in a security-sensitive calculation.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Integer overflow or underflow
Arithmetic exceeds a number type's range, which can make sizes or checks incorrect.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Missing authentication
A sensitive function is reachable without proving who is using it.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-306
OS command injection
Input changes a command that the server runs through its operating system.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-78
Out-of-bounds write
A program writes outside the memory region it is allowed to use.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Matched labels: CWE-787
Path traversal
A supplied file path escapes the directory the application intended to allow.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-22
Race conditions
Another operation changes shared state between a check and the action that relies on it.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
SQL injection
Input changes a database command instead of being handled as data.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-89
Server-side request forgery
Input makes a server send a request to an unintended destination.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-918
Stack buffer overflow
A write runs past a buffer on the stack and can overwrite nearby program state.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Matched labels: CWE-121
Template injection
Input becomes part of a server-side template's instructions.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-1336
Type confusion
A program treats an object as a different type and uses its contents incorrectly.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Matched labels: CWE-843
Uncontrolled format strings
Untrusted input becomes formatting instructions that can read or change program memory.
Practice labs · Free account. Advanced: C, assembly and binary exploitation experience are useful.
Matched labels: CWE-134
Uninitialized data
A program uses memory before the required value has been set.
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
Unsafe file uploads
An application accepts a dangerous file type that can later be executed or served unsafely.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-434
Use-after-free
A program uses memory after releasing it, when its contents may belong to something else.
Practice labs · Free account. Requires C, pointers and basic binary exploitation; begin with Freebie (Easy).
Matched labels: CWE-416
XML external entities
An XML parser follows references to outside files or services supplied in a document.
Reading and practice labs · Free account for labs. Basic HTTP knowledge; some labs use Burp Suite.
Matched labels: CWE-611
Matches reviewed 16 October 2026. Automatic link checks detect unreachable pages; they cannot establish that a course’s content or access terms are unchanged.