Monthly
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches `contains()` or `add()`. The `_encode` method in `lib/Net/CIDR/Set/IPv6.pm` accepted unbounded prefix lengths and allocated memory proportional to the supplied value - `::/100000000` produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). No public exploit is identified at time of analysis, but the 16% EPSS score is elevated for a library-level DoS, and vendor-released patch version 0.23 is confirmed available.
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows an unauthenticated remote attacker to crash or hang any application embedding the library by supplying a specially crafted Lottie animation file. The vulnerability stems from missing input-quantity validation across four distinct code paths - precomposition nesting depth, global render-node budgets, Repeater element copy counts, and polystar/polygon point values - each capable of triggering unbounded recursion or resource exhaustion. No public standalone exploit has been identified at time of analysis; upstream fix code is available as GitHub PR #596, though a formally released patched version has not been independently confirmed.
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. The library fails to impose limits on precompositional nesting depth, render node counts, repeater copy quantities, and polygon point values, enabling an attacker to supply a malicious .json Lottie file that drives unbounded memory allocation and recursive rendering work. No public exploit code has been identified at time of analysis, but the upstream fix in PR #596 confirms the attack surface is well-understood; applications embedding rlottie for animated content - including Samsung Smart TVs, Tizen-based devices, and any app rendering Lottie animations - are affected across all versions prior to the patch.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches `contains()` or `add()`. The `_encode` method in `lib/Net/CIDR/Set/IPv6.pm` accepted unbounded prefix lengths and allocated memory proportional to the supplied value - `::/100000000` produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). No public exploit is identified at time of analysis, but the 16% EPSS score is elevated for a library-level DoS, and vendor-released patch version 0.23 is confirmed available.
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows an unauthenticated remote attacker to crash or hang any application embedding the library by supplying a specially crafted Lottie animation file. The vulnerability stems from missing input-quantity validation across four distinct code paths - precomposition nesting depth, global render-node budgets, Repeater element copy counts, and polystar/polygon point values - each capable of triggering unbounded recursion or resource exhaustion. No public standalone exploit has been identified at time of analysis; upstream fix code is available as GitHub PR #596, though a formally released patched version has not been independently confirmed.
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. The library fails to impose limits on precompositional nesting depth, render node counts, repeater copy quantities, and polygon point values, enabling an attacker to supply a malicious .json Lottie file that drives unbounded memory allocation and recursive rendering work. No public exploit code has been identified at time of analysis, but the upstream fix in PR #596 confirms the attack surface is well-understood; applications embedding rlottie for animated content - including Samsung Smart TVs, Tizen-based devices, and any app rendering Lottie animations - are affected across all versions prior to the patch.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.