Monthly
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS can be triggered by a remote, unauthenticated attacker who has already completed the initial IKEv2 handshake, causing the iked process to crash and interrupting IPsec VPN service. Only Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable are exposed; the flaw is confined to availability (no confidentiality or integrity impact), and the practical blast radius is narrower than the 8.2 base score suggests because a valid IKEv2 session state must exist before the crafted encrypted message can be delivered. There is no public exploit identified at time of analysis, and no confirmed report of active exploitation. The vendor advisory is available at https://psirt.watchguard.com/CVE-2026-86133.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Denial of service in MikroTik RouterOS: an on-path attacker able to inject a BGP UPDATE into an established session can crash the device's BGP routing service with a single malformed MP_REACH_NLRI UPDATE whose labelled-VPN NLRI carries a prefix-length below the minimum valid value. Affected are RouterOS builds before 7.25beta4 that run the routing/BGP service with the labelled-VPN VPNv4 or VPNv6 address family enabled; the malformed route passes NLRI validation, describes an address portion of negative length, terminates the session without a NOTIFICATION, and can be resent to hold down the BGP plane indefinitely. The exploit requires a peer or man-in-the-middle position on the peering link rather than arbitrary off-path internet access, no public exploit code was identified at time of analysis, and the vendor has released a fix in the 7.25beta4 development build.
ZenHive mpp versions 0.14.0 through 0.16.1 fail to charge clients that hold an open payment channel, allowing an authenticated client to obtain an unbounded number of paid units from a single signed voucher. The flaw sits in MPP.Session.Actions.accept_voucher/3, which returns the channel unchanged when a voucher's cumulativeAmount equals the already-accepted cumulative amount, so the credential verifies, the protected resource is served, and no spend is recorded; because the server issues a fresh challenge per request and the replay store keys only on challenge id plus payload, the same voucher can be re-presented under every new challenge. The result is a high-integrity billing/accounting bypass (CVSS 4.0 7.1, PR:L) reachable over the network through the Plug, MCP, JSON-RPC and WebSocket transports; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.
Denial of service in source-map-js up to and including 1.2.1 allows an attacker who can supply an indexed source map to hang the Node.js process: the library reads the per-section offset.line value without bounds checking, so an arbitrarily large integer forces a long synchronous loop that blocks the event loop and starves all other requests. The flaw (CWE-1284, improper validation of a specified quantity) is reachable only where a service actually parses attacker-controlled maps - for example an online transpiler, upload-accepting bundler service, or error/stack-trace resolver - since source maps are normally trusted build-time artifacts; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that data-flow prerequisite, and no public exploit was identified at time of analysis. Impact is availability only; despite the 'Information Disclosure' tag in some feeds, there is no confidentiality or integrity loss in the assessed vector.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS can be triggered by a remote, unauthenticated attacker who has already completed the initial IKEv2 handshake, causing the iked process to crash and interrupting IPsec VPN service. Only Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable are exposed; the flaw is confined to availability (no confidentiality or integrity impact), and the practical blast radius is narrower than the 8.2 base score suggests because a valid IKEv2 session state must exist before the crafted encrypted message can be delivered. There is no public exploit identified at time of analysis, and no confirmed report of active exploitation. The vendor advisory is available at https://psirt.watchguard.com/CVE-2026-86133.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Denial of service in MikroTik RouterOS: an on-path attacker able to inject a BGP UPDATE into an established session can crash the device's BGP routing service with a single malformed MP_REACH_NLRI UPDATE whose labelled-VPN NLRI carries a prefix-length below the minimum valid value. Affected are RouterOS builds before 7.25beta4 that run the routing/BGP service with the labelled-VPN VPNv4 or VPNv6 address family enabled; the malformed route passes NLRI validation, describes an address portion of negative length, terminates the session without a NOTIFICATION, and can be resent to hold down the BGP plane indefinitely. The exploit requires a peer or man-in-the-middle position on the peering link rather than arbitrary off-path internet access, no public exploit code was identified at time of analysis, and the vendor has released a fix in the 7.25beta4 development build.
ZenHive mpp versions 0.14.0 through 0.16.1 fail to charge clients that hold an open payment channel, allowing an authenticated client to obtain an unbounded number of paid units from a single signed voucher. The flaw sits in MPP.Session.Actions.accept_voucher/3, which returns the channel unchanged when a voucher's cumulativeAmount equals the already-accepted cumulative amount, so the credential verifies, the protected resource is served, and no spend is recorded; because the server issues a fresh challenge per request and the replay store keys only on challenge id plus payload, the same voucher can be re-presented under every new challenge. The result is a high-integrity billing/accounting bypass (CVSS 4.0 7.1, PR:L) reachable over the network through the Plug, MCP, JSON-RPC and WebSocket transports; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.
Denial of service in source-map-js up to and including 1.2.1 allows an attacker who can supply an indexed source map to hang the Node.js process: the library reads the per-section offset.line value without bounds checking, so an arbitrarily large integer forces a long synchronous loop that blocks the event loop and starves all other requests. The flaw (CWE-1284, improper validation of a specified quantity) is reachable only where a service actually parses attacker-controlled maps - for example an online transpiler, upload-accepting bundler service, or error/stack-trace resolver - since source maps are normally trusted build-time artifacts; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that data-flow prerequisite, and no public exploit was identified at time of analysis. Impact is availability only; despite the 'Information Disclosure' tag in some feeds, there is no confidentiality or integrity loss in the assessed vector.