Monthly
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact.
Denial of service in Ericsson Packet Core Gateway (PCG) versions prior to 1.30 allows an adjacent-network attacker to degrade service by continuously transmitting malformed messages that the gateway fails to parse safely. The condition causes recurring crashes that persist only while the attack is active, with automatic recovery once it stops, and no public exploit identified at time of analysis.
Denial of service in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated remote attackers to crash the service by submitting a specially crafted SQL query that the server fails to parse safely. The flaw, reported by CERT-PL, results in unexpected termination of the Pro Cloud Server process, and no public exploit identified at time of analysis. The vendor did not respond to disclosure, so the full vulnerable version range remains unconfirmed.
Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated network attackers to crash the server via crafted XDR-encoded op_response packets. The xdr_status_vector() function fails to handle isc_arg_cstring status vector types during packet decoding, triggering immediate server termination. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and CWE-228 (Improper Handling of Syntactically Invalid Structure), this represents a high-severity availability risk for internet-exposed Firebird instances. No active exploitation confirmed, but exploit development is trivial given the low attack complexity.
HTTP Server input validation failures in Cisco IOS and IOS XE Release 3E enable authenticated remote attackers to trigger device reloads via malformed requests, causing denial of service. An attacker with valid credentials can exploit improper input handling to exhaust watchdog timers and force unexpected system restarts. No patch is currently available for this vulnerability affecting Cisco and Apple products.
Unbounded memory buffering in msgpack5 before 6.1.0 allows a remote peer to exhaust the memory of a Node.js or browser process that feeds attacker-controlled data into the library's streaming decoder. Because the reserved MessagePack byte 0xc1 is classified as incomplete rather than invalid input, the decoder holds every subsequent byte in its internal buffer list while waiting for a continuation that can never arrive; the defect is fixed in 6.1.0. This is a moderate-severity availability issue (CVSS 5.9, network-reachable, no authentication or user interaction required, availability-only impact) and no public exploit code was identified at time of analysis. Only deployments that stream untrusted MessagePack input into the decoder are realistically exposed; applications that decode trusted or fully buffered and validated input, or that already bound stream size and duration, are not meaningfully affected.
Denial-of-service in Ericsson Packet Core Controller (PCC) versions prior to 1.39 allows an adjacent-network attacker without credentials to degrade service by flooding the controller with specially crafted messages. The CVSS 4.0 score of 7.1 reflects high availability impact with no confidentiality or integrity loss; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required.
Applications running affected versions of Ehcache 3.x (shipped commercially as IBM Terracotta) can have their cache-write path slowed by remote attackers who can influence the cache keys the application supplies. The issue only materializes when an application derives cache keys from external, attacker-controlled input and passes them into Ehcache in an unfiltered or unsalted form, allowing crafted keys to degrade write throughput; applications that hash, salt, validate, or internally generate their keys are not exposed. The vendor-assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:L) and an EPSS score of 0.21 percent (10th percentile) place this as a low-priority availability nuisance rather than a data-compromise or code-execution risk, and no public exploit identified at time of analysis.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact.
Denial of service in Ericsson Packet Core Gateway (PCG) versions prior to 1.30 allows an adjacent-network attacker to degrade service by continuously transmitting malformed messages that the gateway fails to parse safely. The condition causes recurring crashes that persist only while the attack is active, with automatic recovery once it stops, and no public exploit identified at time of analysis.
Denial of service in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated remote attackers to crash the service by submitting a specially crafted SQL query that the server fails to parse safely. The flaw, reported by CERT-PL, results in unexpected termination of the Pro Cloud Server process, and no public exploit identified at time of analysis. The vendor did not respond to disclosure, so the full vulnerable version range remains unconfirmed.
Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated network attackers to crash the server via crafted XDR-encoded op_response packets. The xdr_status_vector() function fails to handle isc_arg_cstring status vector types during packet decoding, triggering immediate server termination. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and CWE-228 (Improper Handling of Syntactically Invalid Structure), this represents a high-severity availability risk for internet-exposed Firebird instances. No active exploitation confirmed, but exploit development is trivial given the low attack complexity.
HTTP Server input validation failures in Cisco IOS and IOS XE Release 3E enable authenticated remote attackers to trigger device reloads via malformed requests, causing denial of service. An attacker with valid credentials can exploit improper input handling to exhaust watchdog timers and force unexpected system restarts. No patch is currently available for this vulnerability affecting Cisco and Apple products.
Unbounded memory buffering in msgpack5 before 6.1.0 allows a remote peer to exhaust the memory of a Node.js or browser process that feeds attacker-controlled data into the library's streaming decoder. Because the reserved MessagePack byte 0xc1 is classified as incomplete rather than invalid input, the decoder holds every subsequent byte in its internal buffer list while waiting for a continuation that can never arrive; the defect is fixed in 6.1.0. This is a moderate-severity availability issue (CVSS 5.9, network-reachable, no authentication or user interaction required, availability-only impact) and no public exploit code was identified at time of analysis. Only deployments that stream untrusted MessagePack input into the decoder are realistically exposed; applications that decode trusted or fully buffered and validated input, or that already bound stream size and duration, are not meaningfully affected.
Denial-of-service in Ericsson Packet Core Controller (PCC) versions prior to 1.39 allows an adjacent-network attacker without credentials to degrade service by flooding the controller with specially crafted messages. The CVSS 4.0 score of 7.1 reflects high availability impact with no confidentiality or integrity loss; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required.
Applications running affected versions of Ehcache 3.x (shipped commercially as IBM Terracotta) can have their cache-write path slowed by remote attackers who can influence the cache keys the application supplies. The issue only materializes when an application derives cache keys from external, attacker-controlled input and passes them into Ehcache in an unfiltered or unsalted form, allowing crafted keys to degrade write throughput; applications that hash, salt, validate, or internally generate their keys are not exposed. The vendor-assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:L) and an EPSS score of 0.21 percent (10th percentile) place this as a low-priority availability nuisance rather than a data-compromise or code-execution risk, and no public exploit identified at time of analysis.