Monthly
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer overflow in FreeBSD's ppp(8) PPP daemon enables a local user with access to the ppp(8) command interface to crash the process or execute arbitrary code as root by supplying an oversized PSN endpoint value to the mp_SetEnddisc() function, which copies the input without length validation. FreeBSD 15.1-RELEASE (before p3), 15.0-RELEASE (before p13), and 14.4-RELEASE (before p9) are all confirmed affected per EUVD-2026-66248 and FreeBSD Security Advisory SA-26:60. No public exploit has been identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) indicates limited exploitation interest despite the High CVSS rating.
Out-of-bounds write in FreeBSD's userspace ppp(8) daemon allows a malicious PPP peer to crash the process or execute arbitrary code as root. The flaw is in LcpDecodeConfig(), which fails to validate endpoint discriminator option lengths against the RFC 1717 minimum, enabling memory corruption during LCP negotiation. Affected releases are FreeBSD 15.1-RELEASE prior to p3, 15.0-RELEASE prior to p13, and 14.4-RELEASE prior to p9; no active exploitation or public proof-of-concept has been identified at time of analysis.
Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability masks from truncated ones, leaving server-side channels permanently open without producing a finalization message. Any unauthenticated client reaching the Bolt connector (default TCP 7687) can trigger this pre-authentication stall by sending 32 continuation bytes in the capability mask, causing the decoder to loop on the same unread bytes. The CVSS 4.0 vector carries E:P (proof of concept exists) with a low availability impact; no active exploitation has been confirmed via CISA KEV, but the trivial pre-auth trigger and POC availability increase realistic risk to exposed Bolt endpoints.
Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.
Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.
Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.
Missing length validation for the NEW_TOKEN format in HAProxy Community Edition 3.0 through 3.3 exposes network-accessible deployments to low-integrity and availability impacts via crafted requests. The flaw affects HAProxy Enterprise and ALOHA distributions as well, broadening the potential attack surface beyond the open-source edition. No public exploit code and no CISA KEV listing have been identified at time of analysis; patches are available across all affected release branches. Notably, the 'Information Disclosure' tag attached to this CVE conflicts with the CVSS C:N rating - defenders should consult the vendor advisory to clarify whether memory exposure is a realistic outcome.
Out-of-bounds read/write in the TTSSH2 SSH plugin of Tera Term exposes users who connect to attacker-controlled SSH servers to memory disclosure and process crashes. A malicious SSH server can send crafted packets with inconsistent length parameters during connection establishment, causing the TTSSH2 plugin to read and write beyond allocated buffer boundaries - leaking adjacent memory contents (potentially including session data or credentials) back to the attacker's server. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and unauthenticated server-side position make this a credible threat for Tera Term users in environments where they may connect to untrusted SSH endpoints.
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer overflow in FreeBSD's ppp(8) PPP daemon enables a local user with access to the ppp(8) command interface to crash the process or execute arbitrary code as root by supplying an oversized PSN endpoint value to the mp_SetEnddisc() function, which copies the input without length validation. FreeBSD 15.1-RELEASE (before p3), 15.0-RELEASE (before p13), and 14.4-RELEASE (before p9) are all confirmed affected per EUVD-2026-66248 and FreeBSD Security Advisory SA-26:60. No public exploit has been identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) indicates limited exploitation interest despite the High CVSS rating.
Out-of-bounds write in FreeBSD's userspace ppp(8) daemon allows a malicious PPP peer to crash the process or execute arbitrary code as root. The flaw is in LcpDecodeConfig(), which fails to validate endpoint discriminator option lengths against the RFC 1717 minimum, enabling memory corruption during LCP negotiation. Affected releases are FreeBSD 15.1-RELEASE prior to p3, 15.0-RELEASE prior to p13, and 14.4-RELEASE prior to p9; no active exploitation or public proof-of-concept has been identified at time of analysis.
Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability masks from truncated ones, leaving server-side channels permanently open without producing a finalization message. Any unauthenticated client reaching the Bolt connector (default TCP 7687) can trigger this pre-authentication stall by sending 32 continuation bytes in the capability mask, causing the decoder to loop on the same unread bytes. The CVSS 4.0 vector carries E:P (proof of concept exists) with a low availability impact; no active exploitation has been confirmed via CISA KEV, but the trivial pre-auth trigger and POC availability increase realistic risk to exposed Bolt endpoints.
Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.
Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.
Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.
Missing length validation for the NEW_TOKEN format in HAProxy Community Edition 3.0 through 3.3 exposes network-accessible deployments to low-integrity and availability impacts via crafted requests. The flaw affects HAProxy Enterprise and ALOHA distributions as well, broadening the potential attack surface beyond the open-source edition. No public exploit code and no CISA KEV listing have been identified at time of analysis; patches are available across all affected release branches. Notably, the 'Information Disclosure' tag attached to this CVE conflicts with the CVSS C:N rating - defenders should consult the vendor advisory to clarify whether memory exposure is a realistic outcome.
Out-of-bounds read/write in the TTSSH2 SSH plugin of Tera Term exposes users who connect to attacker-controlled SSH servers to memory disclosure and process crashes. A malicious SSH server can send crafted packets with inconsistent length parameters during connection establishment, causing the TTSSH2 plugin to read and write beyond allocated buffer boundaries - leaking adjacent memory contents (potentially including session data or credentials) back to the attacker's server. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and unauthenticated server-side position make this a credible threat for Tera Term users in environments where they may connect to untrusted SSH endpoints.