Elasticsearch's indexing pipeline contains an algorithmic complexity flaw (CWE-407) that allows any low-privileged authenticated user with document indexing rights to submit a single crafted document that occupies a worker thread in the bounded indexing thread pool for a disproportionate duration, degrading indexing availability on the affected node. Affected versions span both the 8.x and 9.x release lines, with fixes available in 8.19.20 and 9.4.5 per ESA-2026-77. No public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Privilege management bypass in IBM i 7.3 through 7.6 permits remote low-privilege authenticated attackers to circumvent security restrictions and achieve limited unauthorized integrity modifications. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability but imposes high attack complexity and mandatory prior authentication, significantly constraining the realistic attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, consistent with the low base score and high complexity requirement.
Elastic Security's case management API in Kibana fails to enforce the same authorization controls applied in the UI, allowing authenticated low-privileged users to modify case records they are only entitled to view. The vulnerability arises from a mass-assignment flaw (CWE-915/CAPEC-77) where the API accepts object attributes that bypass privilege checks enforced at the UI layer - a classic server-side trust boundary mismatch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low exploitation complexity (AV:N/AC:L/PR:L) makes it accessible to any authenticated insider or compromised low-privilege account.
IBM i versions 7.3 through 7.6 expose sensitive information to remote low-privileged attackers via a byte-count and element-count confusion flaw rooted in CWE-200. An authenticated network attacker can trigger the confusion to receive more data than the system should return, leaking sensitive content without user interaction. No active exploitation has been confirmed, no public proof-of-concept has been identified, and IBM has released a patch via their support portal.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Kibana's Machine Learning space management feature performs an incomplete authorization check when removing a saved object from a space, accepting trained models as targets while only verifying privileges for anomaly detection jobs and data frame analytics jobs. Authenticated users whose roles grant ML job creation rights but lack the trained model privilege can therefore remove a trained model from the active space, despite having no legitimate authority over trained models. No public exploit is identified and this vulnerability is not listed in CISA KEV; real-world impact is bounded by the reversibility of the action and the non-deletion of the underlying model.
Authorization bypass in Zimbra Collaboration (ZCS) before 10.1.17 allows authenticated users to impersonate other accounts and send emails by exploiting improper permission validation in the SaveDraftRequest SOAP handler. An attacker with a valid low-privilege account can craft SOAP requests that circumvent delegation and send-as permission checks, enabling unauthorized email impersonation without possessing the required access grants. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; the CVSS score of 3.1 reflects the constrained real-world impact.
Incorrect authorization in OpenNMS Meridian and Horizon's v2 Alarm REST API allows any authenticated ROLE_REST user to acknowledge, escalate, or clear alarms attributed to arbitrary usernames, effectively forging audit records without holding delegation privileges. An inverted boolean condition in AlarmRestService.java - `!StringUtils.isNotBlank(ackUser)` instead of `StringUtils.isNotBlank(ackUser)` - renders the credential delegation check dead code for any non-blank username supplied in the request. Users simultaneously holding ROLE_REST and ROLE_READONLY can additionally bypass the read-only restriction to modify alarm state. No public exploit exists and the vulnerability is absent from CISA KEV; vendor-confirmed patches are available via OpenNMS GitHub PR #8755.
Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. No public exploit code has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, but the partial data access bypass represents a real confidentiality and integrity risk for applications relying on RLS as a security boundary.
Cross-tenant run replay in Trigger.dev 4.4.2-4.5.0-rc.3 allows any authenticated API key holder to replay task runs belonging to other tenants by supplying a victim's run `friendlyId` to the replay endpoint, which performs no tenant isolation check. This unauthorized replay consumes victim compute resources and re-executes side effects such as outbound API calls, webhook triggers, and database writes. A secondary chained code path further allows attacker-controlled payload bytes - planted via a separate object-store path-traversal - to become input to the victim task when `payloadType: application/store` is in use. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Silent incomplete replacement of Quadlet unit files in Podman 5.8.x causes stale security-sensitive directives to persist after a `podman quadlet install --replace` operation on non-reflink filesystems. The missing O_TRUNC flag in the file-open call, combined with a non-truncating `io.Copy` fallback when reflink fails, means that if the replacement Quadlet is shorter than the original, trailing content from the old file survives undetected. A local low-privileged user who uses this command to remove a capability grant (e.g., AddCapability) or an extra volume mount may unknowingly leave those directives active, resulting in containers running with unintended elevated privileges or unauthorized data exposure. No public exploit has been identified at time of analysis.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
CPU-exhaustion denial of service affects DNS name parsing logic in packages tracked by Ubuntu, exploitable via crafted DNS messages containing unbounded compression pointer chains (GHSA-pjmc-gx33-gc76). An attacker who can send DNS responses or queries to an affected resolver or client library can cause the parser to follow circular or deeply nested compression pointers indefinitely, consuming CPU until the process becomes unresponsive. No CVSS vector, CWE, or KEV status has been assigned at time of analysis; no public exploit is confirmed.
Integer truncation of a message length field in the EchoLink proxy component may allow an attacker to trigger memory-safety issues by supplying a crafted message whose length, when truncated to a narrower integer type, produces an incorrect boundary calculation. The affected software is EchoLink, a VoIP system used by amateur radio operators to relay audio over the internet via proxy nodes. Ubuntu has reported this issue under GHSA-4g8q-rgxf-fmgf; no public exploit has been identified at time of analysis.
Stack VLA (Variable-Length Array) exhaustion in audio decoders, as tracked under GHSA-xmcv-mjpv-x46q, allows an attacker to trigger unbounded stack allocation by supplying a crafted audio stream or file. Successful exploitation likely results in a stack overflow, causing process crash and denial of service. This vulnerability was reported via Ubuntu's vendor channel; no CVSS score, CWE classification, or KEV status is available at time of analysis.
Denial of service in remotetrx's NetUplink component via a connection object leak that exhausts server-side resources. Reported under GHSA-5xr9-fmm8-7p8x and tracked by Ubuntu as CVE-2026-73142, the flaw allows network-reachable attackers to degrade or halt the remotetrx service by triggering repeated connections that are never fully released. No public exploit has been identified at time of analysis, and no CVSS score has been published.
Denial of service in the rtl_tcp SDR network daemon allows an unauthenticated remote attacker to crash the daemon by sending a malformed greeting during the TCP handshake phase, causing an unhandled exit. The affected software is the rtl_tcp server component, which exposes RTL-SDR radio hardware over a network socket. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was reported via the Ubuntu vendor channel with a corresponding GitHub Security Advisory (GHSA-38fq-mrrg-8rmr).
Unbounded memory growth in the FRN module (GHSA-qccg-7pw6-787v) can lead to resource exhaustion in affected deployments. The vulnerability was reported via Ubuntu's vendor channel and is associated with a GitHub Security Advisory, suggesting it is a library or kernel module-level issue. No CVSS score, CWE classification, or version details have been published at time of analysis, making precise impact assessment limited.
Use-after-free via reentrant client deletion in svxreflector (SvxLink) allows a network-connected client to trigger memory corruption by initiating a disconnect sequence during an already-in-progress client deletion callback. The affected component is the SvxLink conference reflector server used in amateur radio linking systems. If exploitable beyond a crash, this could result in denial of service or arbitrary code execution within the reflector process.
TCL command injection in a reflector client component, reported via Ubuntu's vendor security channel (GHSA-pc2g-2p95-4cr5), allows an attacker to inject arbitrary TCL commands through unsanitized input processed by the client. The specific impact scope - including whether this enables OS-level command execution or is confined to the TCL interpreter - cannot be confirmed from available data, as no CVSS vector, CWE, or patch advisory has been published. No public exploit or CISA KEV listing has been identified at the time of analysis.
Use-after-free write in svxreflector, the reflector server component of the SvxLink amateur radio internet linking system, occurs when a dangling JSON reference is dereferenced after the underlying object has been freed. The vulnerability was disclosed via GitHub Security Advisory GHSA-6wgq-wg3w-jgvx and is tracked in Ubuntu's package ecosystem. Depending on attacker-controlled input over the network, exploitation could lead to memory corruption with potential for code execution or service disruption.
Out-of-bounds read in NetRx's audio message handling exposes memory contents and may cause service disruption when processing crafted MsgAudio payloads with unvalidated length fields. The affected component fails to validate the length field of incoming MsgAudio messages before using it to index or copy memory, a classic CWE-125-class flaw. Reported via Ubuntu's vendor channel; no public exploit or CISA KEV listing has been identified at time of analysis.
remotetrx, a network-accessible remote transceiver control daemon (part of the SvxLink amateur radio suite), exposes two compounding weaknesses: unvalidated audio payload length processing and insufficiently restricted transceiver control interfaces. An attacker with network access to the remotetrx service can exploit the unvalidated audio length to trigger memory-safety violations, and separately interact with exposed transceiver control functions without expected authorization barriers. No CVSS score, CWE classification, or KEV status is present in the source data; no public exploit has been identified at time of analysis.
Buffer overflow in APRS (Automatic Packet Reporting System) message construction affects software tracked under GHSA-4f8x-49pf-3x5v, reported via the Ubuntu vendor channel. The flaw occurs during the construction of APRS protocol messages, where insufficient bounds checking may allow memory corruption. No CVSS score, vector, or CWE has been assigned at time of analysis, leaving severity and exploitability unconfirmed.
Out-of-bounds read in EchoLink's RTCP/SDES packet processing exposes the application to potential memory disclosure or crash when handling malformed RTCP Source Description (SDES) packets over a network connection. EchoLink, a VoIP-over-internet system for licensed amateur radio operators, processes RTCP control packets as part of its real-time communication protocol stack. No public exploit code has been identified at time of analysis, and exploitation conditions beyond network reachability are not confirmed from available data.
Unbounded request accumulation in an HTTP server component affects a package distributed via Ubuntu, enabling remote attackers to exhaust server resources by sending requests faster than they are processed or discarded. The vulnerability is tracked under GHSA-58ph-q79f-7x9x and reported through Ubuntu's vendor security channel. No CVSS score, KEV listing, or public exploit has been confirmed at time of analysis, but the network-exploitable DoS class is typically low-complexity to trigger.
Stack overflow in StationData::setData exposes affected systems to potential memory corruption. The vulnerability is identified via GHSA-5g48-xjmf-7p4q and reported through Ubuntu's vendor channel, suggesting it affects a library or component present in Ubuntu-distributed packages. Specific impact scope is limited by the near-total absence of structured metadata in available intelligence sources.
Memory-amplification denial of service in a DNS parsing component reported via Ubuntu affects systems that process DNS messages with unvalidated header record counts. An attacker who can send crafted DNS packets can cause the affected parser to allocate memory proportional to attacker-controlled count fields, exhausting available memory and crashing the service. No CVSS score, KEV listing, or public exploit has been confirmed for this CVE at time of analysis.
RX ring stall in the Linux kernel's ENET (Freescale/NXP i.MX Ethernet) interrupt handler causes a network denial-of-service on affected embedded platforms. When an error occurs during packet reception in ENET_IRQHandler, the RX descriptor is not re-owned (returned to hardware DMA control), causing the hardware to believe all remaining descriptors are still held by software and halting all further packet reception. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV, but the network-reachable trigger path means a remote attacker on an adjacent or routed network could potentially stall the interface by provoking the error condition.
Out-of-bounds read in Mongoose's TLS client handshake parser exposes applications using the library's built-in TLS stack to memory disclosure or crash when connecting to a malicious or attacker-controlled TLS server. The flaw resides in mg_tls_client_recv_hello, where a size_t underflow in the ext_len bounds check allows a fixed-offset OOB read beyond the valid message buffer. Reported via an Ubuntu vendor advisory; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Memory misalignment in the Linux kernel's Broadcom/Cypress WiFi SPI driver (brcmfmac) allows incorrect buffer indexing in the cyw_spi_tx function. The function indexes a uint32_t* buffer using a raw byte offset, causing pointer arithmetic to advance by word-sized (4-byte) units when byte-sized steps were intended. Depending on how this misalignment manifests at runtime, consequences may range from corrupted SPI transmit data to an out-of-bounds memory access within the kernel, potentially causing a kernel panic or memory corruption on affected devices. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in the Linux kernel's IPv6 Neighbor Discovery Protocol stack via the rx_ndp_na handler allows a network-adjacent attacker to trigger a read beyond allocated memory by sending a crafted Neighbor Advertisement packet with a missing or malformed option length field. Affected systems are those running a vulnerable kernel version with IPv6 enabled. Impact is most likely a kernel crash (denial of service) or potential kernel memory disclosure, depending on memory layout at the time of exploitation. No public exploit and no KEV listing identified at time of analysis.
Out-of-bounds read in DHCP options parsing exposes systems running an Ubuntu-maintained networking component to potential memory disclosure or denial-of-service when processing malformed DHCP packets. The vulnerability arises from a size_t integer underflow in the rx_ip path when handling truncated DHCP options fields, allowing an attacker-controlled DHCP server on the local network segment to trigger reads beyond allocated buffer boundaries. No public exploit code has been identified at time of analysis, and exploitation probability data is unavailable due to the recency of this disclosure.
TLS certificate expiry validation in an Ubuntu component uses a hardcoded date string '2025-01-01' instead of the current system time, causing certificate validity checks to produce incorrect results for any certificate whose notAfter field is evaluated against this static anchor. Affected systems may incorrectly accept expired certificates or reject valid ones depending on implementation logic. No CVSS score, CWE classification, KEV listing, or EPSS data is available at time of analysis.
Out-of-bounds read in Mongoose's TLS stack during Client Hello parsing exposes services built on this embedded networking library to remote memory disclosure or crash. The vulnerable function mg_tls_client_recv_hello fails to properly validate the bounds of the key_share extension - a TLS 1.3 construct - when processing incoming handshake messages, allowing a remote attacker to trigger the flaw without authentication before any TLS session is established. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the pre-authentication network exposure and trivial triggering conditions make this a meaningful risk for any Mongoose-based service with TLS enabled.
RSA-PSS signature verification in a TLS library's CertificateVerify processing validates only the mandatory 0xbc trailer byte rather than performing complete cryptographic verification of the PSS-encoded signature structure. This flaw, reported by Ubuntu, could allow a remote attacker to forge RSA-PSS CertificateVerify messages during a TLS handshake, potentially enabling authentication bypass without possession of a valid private key. No public exploit or CISA KEV entry is associated with this CVE at time of analysis.
Ubuntu's IPv6 network stack fails to validate the MTU value carried in NDP Router Advertisement (RA) messages, allowing any arbitrary MTU value to be accepted by the host. An attacker with the ability to send crafted IPv6 RA packets on the local network segment can set an excessively low or malformed MTU, disrupting IPv6 connectivity or causing packet-handling anomalies. No CVSS score, CWE classification, KEV listing, or POC has been provided at time of analysis, so severity and exploitability remain unconfirmed.
Out-of-bounds read in the Mongoose networking library's mg_der_to_tlv function allows processing of crafted DER-encoded data with malformed long-form length fields to read memory beyond the intended buffer boundary. Affected deployments include any application embedding Mongoose that processes TLS certificates or other DER-encoded structures from untrusted sources. An attacker who can supply crafted DER input may cause information disclosure from adjacent memory or trigger a crash, depending on memory layout.
Unbounded recursion in Mongoose's DER parsing function mg_der_find_oid allows a remote attacker to trigger a stack overflow by sending crafted ASN.1/DER data containing deeply nested constructed tags, likely resulting in a denial of service through process crash. Affected deployments include any application using Mongoose's TLS or certificate-parsing code paths that process externally-supplied DER-encoded input. No public exploit has been identified at time of analysis, and this vulnerability was reported via the Ubuntu vendor channel.
Off-by-one out-of-bounds read in an HTTP chunked transfer encoding parser - specifically in the CRLF check within a skip_chunk code path - affects software distributed via Ubuntu. The flaw allows network-accessible parsing code to read one byte past a valid buffer boundary when processing chunked HTTP request or response data. Depending on memory layout, this may yield information disclosure or a process crash; no public exploit has been identified at time of analysis and no CVSS vector is available to further qualify scope.
Infinite loop in PPP option parsing exposes the pppd daemon to denial-of-service when a zero-length PPP option is encountered during link negotiation. Affected systems running pppd can be hung indefinitely by a malicious or malformed peer that sends a crafted LCP/NCP option with zero length, causing the find_opt function to spin without advancing its parse cursor. No patch version or CVSS data is available at time of analysis; exploitation conditions and scope are inferred from the description and Ubuntu vendor report alone.
Null pointer dereferences triggered by out-of-memory conditions affect a compression or codec library packaged by Ubuntu, impacting functions precompute_slide_window, more_comps (after failed calloc), and bi_initialize/alloc. Exploitation of these conditions can cause process crashes, resulting in denial of service for any application that processes attacker-supplied data through the affected library. No active exploitation is confirmed; no CVSSv3 score or CWE classification has been assigned at time of analysis.
Out-of-bounds read in Mongoose's TLS server handshake function mg_tls_server_recv_hello exposes systems to memory disclosure or service disruption via a crafted TLS ClientHello packet. An unauthenticated remote attacker can trigger the vulnerability by supplying a malformed session_id_len field during TLS negotiation, before any authentication occurs. No public exploit has been identified at time of analysis, and the disclosure originates from Ubuntu vendor reporting, suggesting a downstream package audit or fuzzing discovery.
Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.
Cryptographically weak TLS secret generation in Cesanta's Mongoose embedded networking library exposes TLS sessions to potential decryption by network observers. The mg_random() function falls back to the standard C library rand() - a non-cryptographic PRNG with predictable output - when a proper entropy source is unavailable, generating TLS keying material that can be predicted or brute-forced. No public exploit has been identified at time of analysis, and no KEV listing exists, but the structural weakness is deterministic on platforms lacking a secure entropy source.
Integer overflow in the rx_dhcp_client DHCP implementation allows a malicious or compromised DHCP server on the local network to trigger a 32-bit wraparound when converting DHCP lease durations from seconds to milliseconds. Affected systems processing a crafted DHCP lease response may experience incorrect lease expiry timing, premature lease renewal loops, or DHCP client process instability - potentially resulting in loss of network connectivity. No public exploit has been identified at time of analysis, and this CVE was reported via Ubuntu's vendor channel, suggesting discovery during internal auditing or upstream review.
Stack-based buffer overflow in the opendir() implementation triggered via unbounded wcscat() concatenation when processing paths at or near the MAX_PATH boundary. Callers supplying a crafted, maximally-long wide-character directory path can overflow a stack buffer, potentially leading to memory corruption, denial of service via crash, or - depending on stack layout and mitigations - arbitrary code execution. Ubuntu has reported this as a vendor-tracked issue; exploitation conditions and patch availability are not yet fully confirmed from available data.
Insufficient data exists to characterize CVE-2026-61551. The only available intelligence is a reporter attribution of 'vendor:ubuntu' and a description reading 'security update' - neither of which identifies the affected component, vulnerability class, or attacker capability. No CVSS score, vector, CWE, or advisory reference was provided. This record cannot be meaningfully assessed until Ubuntu publishes a substantive advisory.