Monthly
Denial of service in the Go standard library's net/mail package allows remote attackers to exhaust CPU or memory by submitting pathologically crafted email address strings that the consumePhrase routine parses inefficiently while handling RFC 5322 phrases. The flaw affects Go releases through 1.25.9 and the 1.26.0-1.26.2 series, is fixed in Go 1.26.3 and 1.25.10, and publicly available exploit code exists, though EPSS scores exploitation likelihood at only 0.01% and it is not on CISA KEV.
Everest EV charging software prior to version 2025.9.0 contains an improper pointer arithmetic flaw in error handling where integer values are concatenated to strings, allowing local operators with high privileges to read sensitive memory regions including heap and stack data. Public exploit code exists for this vulnerability. The flaw requires user interaction and is resolved in version 2025.9.0, though patches remain unavailable for affected earlier versions.
Denial of service in the Go standard library's net/mail package allows remote attackers to exhaust CPU or memory by submitting pathologically crafted email address strings that the consumePhrase routine parses inefficiently while handling RFC 5322 phrases. The flaw affects Go releases through 1.25.9 and the 1.26.0-1.26.2 series, is fixed in Go 1.26.3 and 1.25.10, and publicly available exploit code exists, though EPSS scores exploitation likelihood at only 0.01% and it is not on CISA KEV.
Everest EV charging software prior to version 2025.9.0 contains an improper pointer arithmetic flaw in error handling where integer values are concatenated to strings, allowing local operators with high privileges to read sensitive memory regions including heap and stack data. Public exploit code exists for this vulnerability. The flaw requires user interaction and is resolved in version 2025.9.0, though patches remain unavailable for affected earlier versions.