Monthly
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
An off-by-one heap buffer overflow in libconfini 1.16.4's bundled example utility load_ini_buffer (examples/utilities/load_ini_buffer.h) can crash the process that embeds it, producing a denial of service. The flaw is only reachable when consuming software actually compiles and feeds attacker-influenced input to that example utility; it is not reachable through the core libconfini parsing API alone, and impact is availability-only with no code execution or data disclosure indicated. Exploitation requires an unauthenticated network-reachable path into the affected utility (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L per independent assessment, versus the submitter's N/A:H rating), and no public exploit has been identified; EPSS is 0.29% (20th percentile), consistent with a low-to-moderate real-world priority.
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.
Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Unauthenticated remote denial of service in SODOLA SL902-SWTGW124AS switch firmware before version 200.2.12 lets any attacker who can reach the device's embedded HTTP management server crash it by sending a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header. The overflow leaves the switch fully unresponsive, dropping both management access and traffic forwarding until its self-recovery cycle completes, though the assessment confirms no code execution, data disclosure, or configuration tampering occurs. Publicly available exploit code exists (published by the researcher and documented in the VulnCheck advisory), and the CVE carries a CVSS v4.0 base score of 8.7, but there is no indication of confirmed active exploitation in CISA KEV; the practical risk is governed mainly by whether the web management plane is exposed to attacker-reachable networks.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
An off-by-one heap buffer overflow in libconfini 1.16.4's bundled example utility load_ini_buffer (examples/utilities/load_ini_buffer.h) can crash the process that embeds it, producing a denial of service. The flaw is only reachable when consuming software actually compiles and feeds attacker-influenced input to that example utility; it is not reachable through the core libconfini parsing API alone, and impact is availability-only with no code execution or data disclosure indicated. Exploitation requires an unauthenticated network-reachable path into the affected utility (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L per independent assessment, versus the submitter's N/A:H rating), and no public exploit has been identified; EPSS is 0.29% (20th percentile), consistent with a low-to-moderate real-world priority.
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.
Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.