Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. 169.254.169.254), yielding high-confidence disclosure of internal data and credentials. There is no public exploit identified at time of analysis, but the upstream fixing commit is public, and no EPSS or CISA KEV data was supplied.
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. There is no public exploit identified at time of analysis, but the fix is confirmed in release 2.26.7.
Local privilege escalation in open-iscsi's iscsiuio component lets any unprivileged local user connect to the iscsiuio control socket and issue commands normally restricted to root, because the daemon validated peer credentials against the wrong file descriptor. The flaw (CWE-863 Incorrect Authorization) was reported by SUSE and fixed upstream in commit 668ca1df; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. No public exploit identified at time of analysis, though the vendor-scored CVSS 4.0 base is 8.4 (high).
Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.
Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Improper access control in GitLab CE/EE exposes CI/CD test report contents to authenticated users holding only guest-role permissions, allowing unauthorized read access to data from projects they should not be able to view. Affected versions span 18.4 through pre-19.0.5, 19.1 through pre-19.1.3, and 19.2 through pre-19.2.1. Publicly available exploit code exists via a disclosed HackerOne report, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers to trigger unbounded recursion while the plugin fetches attacker-controlled URLs, exhausting server resources. It affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 when the ESI plugin is enabled. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cache poisoning and content-type confusion in the Apache Traffic Server webp_transform plugin allows remote clients to induce the proxy to decode images unsafely and store mislabeled, cacheable responses that are then served to other users. Affected releases span the 8.x (through 8.1.9), 9.x (through 9.2.14), and 10.x (through 10.1.3) branches when the optional webp_transform plugin is enabled. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided, so risk here is driven by the CVSS 8.2 (CVSS 4.0) rating rather than observed exploitation.
Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.
Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the cJSON_Compare() function, which recursively descends into each shared object subtree twice per level with no depth guard. Applications that call cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document can be forced to burn hours of CPU on a document of only a few hundred bytes (nesting depth around 40), with cost roughly doubling per added level. No public exploit identified at time of analysis and the issue is not on CISA KEV; impact is compute exhaustion only, with no confidentiality or integrity effect.
Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/browser thread by supplying a negative size to the customAlphabet or nanoid functions of the non-secure module (nanoid/non-secure). Because the internal loop counter is decremented from a negative starting value, it never satisfies its termination condition and spins forever, consuming CPU and blocking the event loop. Reported by VulnCheck with a patch shipped in 5.1.16; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread by supplying a size value of 0 to the customAlphabet or customRandom generator functions, triggering an unbounded internal loop (CWE-835). Only applications that forward an unvalidated, attacker-controlled size parameter to these functions are exposed. A vendor patch exists (5.1.6) and the issue was reported by VulnCheck, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113).
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Local privilege escalation potential via memory corruption in the Linux kernel's perf/core subsystem, where perf_event_remove_on_exec() fails to detach group relationships when removing a group-leader event during exec. On affected kernels, a local user who can open perf events can corrupt the PMU context active list through a double list_add, undermining kernel memory integrity (CVSS 7.8, C:H/I:H/A:H). EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in G DATA Total Security lets a low-privileged user abuse the Backup Service to delete an arbitrary file via a symbolic link (CWE-59 link following), which can be leveraged to run arbitrary code as NT AUTHORITY\SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-432, ZDI-CAN-28665); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 3.0 base score is 7.8 (High), reflecting full SYSTEM-level compromise achievable by any authenticated local user.
Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation.
Local information disclosure in the Linux kernel s390 protected-key (pkey) subsystem affects IBM Z (s390x) mainframe systems where the PKEY_VERIFYPROTK ioctl fails to validate the user-supplied buffer length before processing, allowing a local low-privileged user with access to the pkey device to trigger an out-of-bounds kernel memory access. Fixed by explicitly checking the request length against the buffer size and failing when it exceeds it. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Local privilege-impacting memory corruption in the Linux kernel's s390 (IBM Z) pkey subsystem allows a low-privileged local user to trigger an out-of-bounds write through the pkey_pckmo key_to_protkey() handler, which failed to validate that generated protected-key output fits within the caller-provided target buffer. The flaw affects s390 builds of the kernel prior to the fixed stable releases and carries high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-escalation/denial-of-service in the Linux kernel's POSIX CPU timers subsystem arises from a use-after-free triggered by a race between sys_timer_delete() and a non-leader exec(). When de_thread() switches the thread-group leader and releases the old leader, posix_cpu_timer_del() can observe the stale leader with a now-NULL sighand, return without unqueueing an armed TGID-targeted timer, and free the underlying k_itimer while its timerqueue node remains enqueued in p->signal - leaving run_posix_cpu_timers() and other timer add/delete operations to dereference freed memory. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in stable releases.
Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets remote attackers read arbitrary files in the context of the service account by supplying a crafted path that is used unvalidated in file operations. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-287 / ZDI-CAN-28722), it carries a CVSS 3.0 base score of 7.5 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arbitrary files via directory traversal, exposing sensitive data in the context of the service account. The flaw stems from missing validation of a user-supplied path before it is used in file operations (CWE-22). Discovered and reported through the Zero Day Initiative (ZDI-26-284 / ZDI-CAN-28746); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Improper input validation in Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 lets remote attackers send malformed input that the proxy fails to validate, allowing manipulation of the integrity of downstream/backend traffic (e.g. request smuggling or response manipulation against systems behind the proxy). The CVSS 4.0 score is 7.7 (High), driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Package integrity bypass in the Gleam build tool (compiler-cli) versions 0.18.0 up to 1.18.0 lets an adversary-in-the-middle substitute forged Hex dependency contents during resolution. Although Gleam fetches signature-verified registry metadata, gleam_cli::dependencies::lookup_package instead recorded the SHA-256 outer_checksum and dependency names from a second, unsigned Hex API call into manifest.toml, so the forged tarball validates against its own forged checksum. Exploitation requires an attacker who can both perform TLS interception with a CA trusted by the Gleam process and modify the tarball; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.
Uncontrolled resource consumption in Node.js HTTP/2 implementation allows unauthenticated remote attackers to exhaust server memory and cause denial of service by sending crafted requests that bypass session-level header memory accounting. Affected is Node.js v22.x LTS ('Jod' line) prior to v22.23.2, fixed in the security release published 2026-07-29. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects realistic network-level exploitability with no authentication barrier.
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProvider class, which exposes functionality without any authentication check (CWE-306). Any network-reachable attacker can send requests that trigger the availability impact without credentials or user interaction. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was discovered and reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29041 / ZDI-26-272).
Denial of service in GitLab CE/EE (all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an unauthenticated attacker to exhaust server resources through insufficient throttling when the application processes merge request discussions. Vendor-reported by GitLab with no public exploit identified at time of analysis; the availability-only impact (CVSS 7.5, A:H) reflects service disruption rather than data compromise. Exploitation is conditional ('under certain conditions'), which tempers the otherwise network-reachable, no-auth attack surface.