Monthly
Denial of service in the Erlang OTP ssl application allows a malicious or man-in-the-middle TLS 1.3 server to crash the node-global session-ticket store on a connecting client, and repeated crashes can exhaust the ssl supervisor restart intensity and take down TLS for every connection on that node. The victim must be a TLS 1.3 client running OTP 23.3 through the fixed releases with session_tickets set to auto (automatic ticket storage and resumption); the crash does not occur when the bogus ticket is received but on the next automatic resumption attempt, and it requires the client to initiate the outbound connection, which is reflected in the assessed AT:P attack-requirement metric and a CVSS 3.1 base of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's CVSS 4.0 score of 8.2. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but vendor patches and upstream commits are available. Reported by the Erlang Ecosystem Foundation (EEF) and tracked as EUVD-2026-101384.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
Transactions built through a remote StorageClient in @bsv/wallet-toolbox 1.1.47 through 2.3.3, @bsv/wallet-toolbox-client 1.1.47 through 2.3.3, and @bsv/wallet-toolbox-mobile 1.3.21 through 2.3.3 can be silently redirected by a malicious or compromised storage provider, which returns output locking scripts the wallet signs without confirming they match the caller's request. Because the provider can substitute a recipient script or append an attacker-controlled output funded by shrinking change, the wallet broadcasts a transaction paying the attacker while the application and user interface still display the intended recipient; the integrity impact is high with no confidentiality or availability effect, and no authentication against the victim wallet is required (CVSS 4.0 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires the application to use a remote StorageClient backend the attacker controls and the user to initiate a transaction through it - local-storage applications and those that independently verify outputs are unaffected; no public exploit code has been identified at time of analysis and the issue is patched in 2.4.0.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote unauthenticated attackers can trigger out-of-bounds memory access in the Linux kernel SMB client's DACL parsing code by sending a malicious SMB response with a truncated DACL structure. The vulnerability exists in build_sec_desc() and id_mode_to_cifs_acl() functions which insufficiently validate server-supplied ACL data before rewriting it during chmod/chown operations, allowing ACE traversal beyond validated memory bounds. CVSS 8.8 indicates high severity with network vector requiring user interaction. EPSS score of 0.02% (5th percentile) suggests low observed exploitation probability in the wild, and no active exploitation is confirmed (not in CISA KEV). Vendor patch available targeting Linux kernel 7.0.2 and 7.1-rc1.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Authenticated annotation slot hijacking in CVAT versions 2.17.0 through 2.71.x enables any user with write access to a single job to deny automatic annotation service to arbitrary other tasks by submitting batch annotation requests with deliberately mismatched task and job IDs. The `RequestViewSet.create` endpoint reserved the single active annotation slot by task ID without validating that the submitted job belonged to that task or that the requester had any access to it, allowing cross-task resource monopolization. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-confirmed fix is available in v2.72.0.
Denial of service in the Erlang OTP ssl application allows a malicious or man-in-the-middle TLS 1.3 server to crash the node-global session-ticket store on a connecting client, and repeated crashes can exhaust the ssl supervisor restart intensity and take down TLS for every connection on that node. The victim must be a TLS 1.3 client running OTP 23.3 through the fixed releases with session_tickets set to auto (automatic ticket storage and resumption); the crash does not occur when the bogus ticket is received but on the next automatic resumption attempt, and it requires the client to initiate the outbound connection, which is reflected in the assessed AT:P attack-requirement metric and a CVSS 3.1 base of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's CVSS 4.0 score of 8.2. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but vendor patches and upstream commits are available. Reported by the Erlang Ecosystem Foundation (EEF) and tracked as EUVD-2026-101384.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
Transactions built through a remote StorageClient in @bsv/wallet-toolbox 1.1.47 through 2.3.3, @bsv/wallet-toolbox-client 1.1.47 through 2.3.3, and @bsv/wallet-toolbox-mobile 1.3.21 through 2.3.3 can be silently redirected by a malicious or compromised storage provider, which returns output locking scripts the wallet signs without confirming they match the caller's request. Because the provider can substitute a recipient script or append an attacker-controlled output funded by shrinking change, the wallet broadcasts a transaction paying the attacker while the application and user interface still display the intended recipient; the integrity impact is high with no confidentiality or availability effect, and no authentication against the victim wallet is required (CVSS 4.0 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires the application to use a remote StorageClient backend the attacker controls and the user to initiate a transaction through it - local-storage applications and those that independently verify outputs are unaffected; no public exploit code has been identified at time of analysis and the issue is patched in 2.4.0.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote unauthenticated attackers can trigger out-of-bounds memory access in the Linux kernel SMB client's DACL parsing code by sending a malicious SMB response with a truncated DACL structure. The vulnerability exists in build_sec_desc() and id_mode_to_cifs_acl() functions which insufficiently validate server-supplied ACL data before rewriting it during chmod/chown operations, allowing ACE traversal beyond validated memory bounds. CVSS 8.8 indicates high severity with network vector requiring user interaction. EPSS score of 0.02% (5th percentile) suggests low observed exploitation probability in the wild, and no active exploitation is confirmed (not in CISA KEV). Vendor patch available targeting Linux kernel 7.0.2 and 7.1-rc1.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Authenticated annotation slot hijacking in CVAT versions 2.17.0 through 2.71.x enables any user with write access to a single job to deny automatic annotation service to arbitrary other tasks by submitting batch annotation requests with deliberately mismatched task and job IDs. The `RequestViewSet.create` endpoint reserved the single active annotation slot by task ID without validating that the submitted job belonged to that task or that the requester had any access to it, allowing cross-task resource monopolization. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-confirmed fix is available in v2.72.0.