Monthly
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Telegram's bundled rlottie library allows an attacker to execute arbitrary code in the context of the current process when a victim opens a malicious Lottie/TGS animation. The flaw is a numeric truncation error (CWE-197) that results in an out-of-bounds write before the start of an allocated buffer, requiring user interaction (UI:R) and high attack complexity (AC:H) to exploit; the CVSS vector is AV:L, indicating a client-side file/content-handling issue. No public exploit has been identified at time of analysis, and no CISA KEV status is present.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Denial of service in the Nezha monitoring dashboard before 2.3.8 lets any authenticated non-administrator account crash the dashboard process by submitting a malformed alert rule (invalid rule type or out-of-bounds duration) to POST /api/v1/alert-rule, which triggers an unrecovered panic in the alert evaluator goroutine. Because the offending rule is persisted, the dashboard enters a crash loop on every restart, taking down monitoring and the control plane until the bad record is manually removed from the backing datastore. No public exploit code was identified at time of analysis, exploitation requires only a low-privileged account (CVSS PR:L) and network reachability to the dashboard API, and impact is confined to availability with no confidentiality or integrity loss.
Ubuntu package maintainers have published a security update tracked as CVE-2026-96280, reported through the vendor:ubuntu intelligence feed. The advisory is described only by the placeholder text 'security update', and the input provides no CVSS score or vector, no CWE classification, no CPE identifiers, no affected version ranges, and no reference URLs, so the specific package, component, and deployment mode in scope cannot be identified. Whether the issue is remotely or locally triggerable, what privilege level an attacker requires, and what the resulting impact would be are all undetermined; no public exploit code has been identified and there is no CISA KEV designation or EPSS score to indicate active exploitation, therefore risk cannot be meaningfully assessed from the provided data and should be treated as unquantified pending NVD or Ubuntu Security Notice enrichment.
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which `named` caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. Vendor patches are available (9.20.29 and 9.21.26); no public exploit identified at time of analysis, and the impact is availability-only with no confidentiality or integrity loss.
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from a numeric truncation error in the Media component, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The vendor patch is available via the September 2026 stable-channel update; no public exploit is identified at time of analysis. Note a signal conflict: Chromium rated this 'Medium' severity while the supplied CVSS base score is 9.6 Critical.
Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. No public exploit identified at time of analysis and no CISA KEV listing is present, but the vulnerability mechanism is fully described in the VulnCheck advisory, lowering the barrier to reproduction.
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Telegram's bundled rlottie library allows an attacker to execute arbitrary code in the context of the current process when a victim opens a malicious Lottie/TGS animation. The flaw is a numeric truncation error (CWE-197) that results in an out-of-bounds write before the start of an allocated buffer, requiring user interaction (UI:R) and high attack complexity (AC:H) to exploit; the CVSS vector is AV:L, indicating a client-side file/content-handling issue. No public exploit has been identified at time of analysis, and no CISA KEV status is present.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Denial of service in the Nezha monitoring dashboard before 2.3.8 lets any authenticated non-administrator account crash the dashboard process by submitting a malformed alert rule (invalid rule type or out-of-bounds duration) to POST /api/v1/alert-rule, which triggers an unrecovered panic in the alert evaluator goroutine. Because the offending rule is persisted, the dashboard enters a crash loop on every restart, taking down monitoring and the control plane until the bad record is manually removed from the backing datastore. No public exploit code was identified at time of analysis, exploitation requires only a low-privileged account (CVSS PR:L) and network reachability to the dashboard API, and impact is confined to availability with no confidentiality or integrity loss.
Ubuntu package maintainers have published a security update tracked as CVE-2026-96280, reported through the vendor:ubuntu intelligence feed. The advisory is described only by the placeholder text 'security update', and the input provides no CVSS score or vector, no CWE classification, no CPE identifiers, no affected version ranges, and no reference URLs, so the specific package, component, and deployment mode in scope cannot be identified. Whether the issue is remotely or locally triggerable, what privilege level an attacker requires, and what the resulting impact would be are all undetermined; no public exploit code has been identified and there is no CISA KEV designation or EPSS score to indicate active exploitation, therefore risk cannot be meaningfully assessed from the provided data and should be treated as unquantified pending NVD or Ubuntu Security Notice enrichment.
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which `named` caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. Vendor patches are available (9.20.29 and 9.21.26); no public exploit identified at time of analysis, and the impact is availability-only with no confidentiality or integrity loss.
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from a numeric truncation error in the Media component, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The vendor patch is available via the September 2026 stable-channel update; no public exploit is identified at time of analysis. Note a signal conflict: Chromium rated this 'Medium' severity while the supplied CVSS base score is 9.6 Critical.
Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. No public exploit identified at time of analysis and no CISA KEV listing is present, but the vulnerability mechanism is fully described in the VulnCheck advisory, lowering the barrier to reproduction.