Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent file descriptors, goroutines, and memory by flooding incomplete connections, rendering the agent unreachable to legitimate clients. Both Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are affected - a span covering nearly three years of releases. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 7.5 score and AV:N/AC:L/PR:N profile reflect a straightforwardly exploitable network condition requiring no attacker authentication or user interaction.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.
Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.
Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
REST API connection exhaustion in Klever-Go versions 1.7.14 through 1.7.17 allows unauthenticated remote attackers to render node API services unavailable by holding slow-header connections open until server file descriptors are exhausted. The root cause is Gin's Engine.Run convenience method, which delegates to Go's default http.ListenAndServe without any ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured, leaving incoming connections open indefinitely if the client never completes request headers. A proof-of-concept documented in GHSA-w4c6-7r69-w7j9 confirmed that 120 such connections caused all 20 of 20 legitimate API probes to fail with 'accept: too many open files' on v1.7.17; no CISA KEV listing was found, and no public exploit beyond the researcher's PoC is identified at time of analysis.
Unbounded goroutine exhaustion in Klever-Go versions 1.7.14-1.7.17 allows any connected libp2p peer to remotely degrade or deny service to a Klever blockchain node by flooding it with well-formed direct messages. The root defect is architectural: `directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns an unrestricted goroutine per incoming message before the processor-level antiflood layer can reject it, meaning admission control is structurally bypassed at ingress. No public exploit code has been identified at time of analysis, though the GHSA advisory provides a precise code walkthrough that substantially lowers exploitation complexity. The fix is available in v1.7.18.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Unauthenticated remote crash in Klever-Go versions 1.7.14-1.7.17 allows any network peer to terminate a node process by gossiping a 3-byte protobuf Transaction with the RawData sub-message omitted, triggering a nil-pointer dereference in the synchronous P2P validation callback with no panic recovery. No account, stake, validator key, or funds are required - the attacker only needs network reachability to the libp2p gossip port. Repeated delivery targeting enough BLS validators can halt block production entirely, constituting a chain-halt attack against the Klever network. No public exploit code or CISA KEV listing was identified, but the trivial payload and zero-prerequisite nature of exploitation make this a high-urgency upgrade target.
Denial-of-service via unbounded recursion in HAPI FHIR prior to 6.9.11 allows an unauthenticated remote attacker to crash parsing and validation worker threads by submitting FHIR resources containing deeply nested XHTML narratives, JSON objects, or XML elements. The commit diff reveals the flaw spans three parsers - XhtmlParser, JsonParser, and XMLUtil - each lacking a nesting depth guard, so crafted input triggers mutual recursion that exhausts the JVM thread stack and raises an unrecoverable StackOverflowError. No public exploit has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the AV:N/AC:L/PR:N/UI:N CVSS vector confirms trivial, unauthenticated exploitation against any internet-facing FHIR endpoint accepting resource submissions.
Unbounded recursive JSON parsing in HAPI FHIR's org.hl7.fhir.utilities.json.parser.JsonParser (versions prior to 6.9.11) allows unauthenticated remote attackers to crash JVM worker threads by submitting a syntactically valid but deeply nested FHIR JSON document. The mutual recursion between readObject() and readArray() carries no depth counter, so a document with as few as ~600 nesting levels exhausts the thread stack and raises a StackOverflowError before structural FHIR validation runs - any service that does not isolate StackOverflowError may lose the worker thread or destabilize the process entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) rating reflects that exploitation requires no authentication and minimal complexity against any exposed FHIR validation endpoint.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected services by sending crafted serialized data containing malformed type metadata, triggering an uncaught Go runtime panic. Affected versions span 0.16.0 through 1.5.0 (exclusive), while all non-Go language implementations remain unaffected. No public exploit code or active exploitation (CISA KEV) has been identified; the EPSS score of 0.18% (8th percentile) corroborates low current exploitation activity despite the high CVSS base score.
Privilege escalation in NexTor IP Changer versions prior to 2.0.0 stems from OS command injection (CWE-78) caused by invoking privileged system commands via `sudo` with `shell=True`, allowing shell metacharacter interpretation of unsanitized input. On systems where passwordless sudo (NOPASSWD) is configured for the executing account, an attacker with local low-privilege access can inject arbitrary OS commands that execute silently with root privileges. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the NOPASSWD requirement and the tool's niche deployment footprint. Version 2.0.0 resolves the issue.
Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. A vendor-released patch is confirmed in Nexus Repository 3.95.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in TestLink 1.9.20 and earlier allows any authenticated user - including low-privilege guest accounts - to retrieve arbitrary file attachments from projects they have no membership in, by supplying sequential integer IDs to the attachmentdownload.php endpoint. The handler performs no project membership or role authorization check, enabling bulk enumeration of all attachments across the entire installation. No public exploit has been confirmed at time of analysis, though a researcher writeup exists; the attack is trivially automatable due to the sequential integer ID scheme.
Server-Side Request Forgery in the Telefunken TE24553B45V2DZ Smart TV firmware V2.78.0.0 allows a network-adjacent unauthenticated attacker to abuse the SmartCenter browserseturl command, redirecting the device's embedded browser to loopback (127.0.0.1) and internal network destinations that are otherwise unreachable through normal browser navigation. The Vestel MB181 / Voltron181 / TiVo OS platform's SmartCenter component fails to restrict target URL schemes and destinations, enabling the TV to serve as an internal SSRF proxy against its own locally-running services. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the zero-privilege, adjacent-network attack posture makes exploitation accessible to any local network attacker, including guests in hospitality deployments.
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.
Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.
The Home Assistant iOS Companion app silently executes tag-triggered automations when any co-installed untrusted app forwards a crafted tag event via iOS universal links, bypassing physical scan validation entirely. Affected versions are all iOS Companion app releases prior to 2026.5.0; the underlying Home Assistant core CPE (cpe:2.3:a:home-assistant:core:*:*:*:*:*:*:*:*) is also cited. Because automations can control physical devices such as smart locks and alarms, the I:H CVSS metric reflects real-world consequences beyond software state. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent automation execution in the Home Assistant Android Companion App prior to 2026.8.1 allows any co-installed app on the device to trigger arbitrary HA automations by forwarding a crafted tag URL to an exported Activity without user confirmation. The flaw exists because TagReaderActivity accepted both physical NFC intents and OS-routed deep links identically, with no caller validation or approval prompt before dispatching the tag scan to the Home Assistant server. No public exploit has been identified at time of analysis, but the attack is unattended and can control physical actuators such as locks or alarms.