Monthly
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 allows unauthenticated remote attackers to terminate the host process by sending malformed frames that the service does not handle correctly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms that no credentials or user interaction are required, so the only practical gating factor is network reachability to the service endpoint; impact is confined to availability with no data disclosure or modification. No public exploit code has been identified at time of analysis, and the vendor has published a patch advisory.
Remote code execution in AnyDesk before 8.0.3 allows unauthenticated attackers to execute arbitrary code as root on Linux by sending a specially crafted packet to the session protocol's stream packet handler for mode 5. The victim does not need to approve desktop control, and publicly available exploit code exists. This is a critical heap-based buffer overflow (CWE-130) with a CVSS score of 9.8, though the assessed root-level impact is specifically demonstrated on Linux and other platforms are not confirmed.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.
Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 allows unauthenticated remote attackers to terminate the host process by sending malformed frames that the service does not handle correctly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms that no credentials or user interaction are required, so the only practical gating factor is network reachability to the service endpoint; impact is confined to availability with no data disclosure or modification. No public exploit code has been identified at time of analysis, and the vendor has published a patch advisory.
Remote code execution in AnyDesk before 8.0.3 allows unauthenticated attackers to execute arbitrary code as root on Linux by sending a specially crafted packet to the session protocol's stream packet handler for mode 5. The victim does not need to approve desktop control, and publicly available exploit code exists. This is a critical heap-based buffer overflow (CWE-130) with a CVSS score of 9.8, though the assessed root-level impact is specifically demonstrated on Linux and other platforms are not confirmed.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.
Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.