Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing and content of authoritative responses to paired queries. When a client asks named to resolve a DNAME plus an A record beneath it (or a CNAME plus an A record for the same name) and the attacker-controlled authoritative server answers the A query positively but delays the DNAME/CNAME response before returning a negative or self-referential answer, named hits a fatal assertion and terminates. The flaw is unauthenticated and network-reachable (CVSS 7.5, availability-only); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone crash the resolver daemon with a single crafted upstream response, but only when the non-default 'dns-error-reporting: yes' option is enabled. The flaw is a stack write triggered while building a DNS Error Report query name from a malformed EDNS Report-Channel option (code 18). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the CVSS 7.5 reflects a pure availability impact (A:H) with no data disclosure despite the vendor's 'Information Disclosure' tag.
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
DNSSEC wildcard validation bypass in PowerDNS Recursor allows an attacker controlling or spoofing DNS responses to forge signed records by supplying RRSIGs whose label count is smaller than required. Because the validator fails to reject RRSIGs with too few labels, a wildcard signature can be replayed to authenticate names it should not cover, letting an attacker present forged-but-'validated' DNS data for a signed zone. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the primary consequence is integrity (data forgery), not confidentiality or denial of service.
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone under an NSEC-signed parent forge insecure DNS answers for unrelated sibling zones sharing that parent. The root cause is insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing, allowing fraudulent wildcard DS records to bring non-existent delegations into 'insecure' existence and inject spoofed records. Reported by NLnet Labs with a 7.5 (High) integrity-only CVSS; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. No active exploitation has been confirmed, but the vulnerability is automatable and carries high integrity impact.
ID Token signature verification bypass in OIDC::Lite Perl library through version 0.12.1 allows unauthenticated remote attackers to forge authentication tokens by controlling the algorithm allowlist used during verification. When a relying party calls the verify method without pinning a specific algorithm, the library extracts the ‘alg’ value from the attacker-controlled token header and passes it as an accepted-algorithm allowlist, enabling ‘alg=none’ (no signature check) or key‑confusion attacks (e.g., RS256 to HS256). An attacker can impersonate any user by crafting a token with arbitrary ‘sub’ claims. No active exploitation has been confirmed, and the EPSS score (0.17%) suggests low immediate threat, but the issue is critical for unpatched systems using the unpinned verification path.
Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.
Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD series) allows remote unauthenticated attackers to retrieve partial sensitive data by sending requests with improperly validated input parameters. The flaw was self-reported by Hikvision and rated CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis. Because these cameras are frequently internet-exposed, the network-reachable, no-authentication nature of the issue makes it a meaningful exposure risk despite the absence of integrity or availability impact.
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.
Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB allows an authenticated attacker to exhaust server CPU by submitting query operations that use deeply nested $jsonSchema validation constructs, producing a runaway CPU-bound operation that cannot be halted via standard administrative controls such as killOp. Reported by MongoDB's own CNA (SERVER-125872) and classified as inefficient algorithmic complexity (CWE-407), with no public exploit identified at time of analysis. The inability to interrupt the operation elevates this above a routine resource-consumption bug because normal recovery tooling is ineffective.
Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) lets any authenticated user with aggregation-pipeline privileges crash the database process by invoking the internal `$_internalIndexKey` aggregation expression against a compound wildcard index. The expression fails to handle compound wildcard index specifications, tripping an internal consistency check (assertion) that aborts the server. No public exploit identified at time of analysis, and the flaw is reported by MongoDB's own CNA as a Denial of Service issue with no confidentiality or integrity impact.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB Server (mongod) allows an authenticated user holding only basic write privileges to crash the database process by submitting a crafted transaction command that omits some required fields. The inconsistent validation of related transaction parameters trips a fatal internal invariant (CWE-617), aborting mongod and interrupting availability for all clients. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; impact is limited to availability, with no data disclosure or integrity effect.
Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in PortProtonQt (the Qt-based front-end for the PortProton Linux gaming launcher) before commit 0d0f0950 lets any unprivileged local user gain root-equivalent control over storage and networking. The shipped Polkit rule authorized privileged udisks2 and NetworkManager actions by inspecting the caller's process command line via `ps` for the string "ppqtos", a check any user can trivially spoof to bypass authorization. There is no public exploit code and it is not in CISA KEV, but the vulnerable rule and its trivial bypass are fully disclosed in the advisory and patch, and the vendor has released a fix (version 1.3.1).
Excessive CPU consumption in MongoDB Server's awaitable hello command exhaust mode allows unauthenticated remote clients to degrade server availability without any credentials. A specific parameter combination triggers a server-side response loop that bypasses normal throttling mechanisms, meaning even a small number of malicious connections can measurably impair database availability. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 with VA:L reflects a real but bounded availability impact.
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
HTTP/2-to-HTTP/1.x protocol translation in Netty's `netty-codec-http2` enables request routing bypass and HTTP request smuggling via duplicate `Host` header injection. When a client sends a HEADERS frame containing both the `:authority` pseudo-header and a literal `host` header, `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter` independently translate each into `Host` headers, producing an `HttpRequest` with two attacker-controlled, differing values. Downstream HTTP/1.1 components that prioritize the second header can be manipulated into routing requests to unintended targets. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but patches are vendor-released for both affected release trains.
Resource exhaustion in Netty's HttpContentEncoder allows unauthenticated remote attackers to crash JVM-based servers via HTTP/1.1 pipelining. The per-channel acceptEncodingQueue accumulates attacker-controlled Accept-Encoding header values on the I/O thread without any bound, and is only drained when the application emits a non-1xx response - meaning a client pipelining requests faster than the server responds can inflate heap usage without limit. Vendor-released patches are available in 4.1.136.Final and 4.2.16.Final; no public exploit or CISA KEV listing is present at time of analysis.
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.
PKCE bypass in librest allows OAuth 2.0 client impersonation by exploiting a cryptographically weak pseudo-random number generator. The library's code verifier generation for PKCE (RFC 7636) uses GLib's GRand function - a non-cryptographic PRNG with a 32-bit seed space - rather than a CSPRNG, enabling a positioned attacker to recover the PRNG seed and reconstruct the code verifier to hijack the token exchange. Rated CVSS 6.8 with high confidentiality and integrity impact; no public exploit or CISA KEV listing identified at time of analysis.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.