Monthly
A truncated HTTP/2 PING frame sent to an HAProxy frontend that accepts HTTP/2 causes the H2 multiplexer to spin in a busy loop, driving worker-thread CPU to saturation and degrading or denying service to legitimate traffic (CVSS 7.5, availability-only). Only deployments with an HTTP/2-enabled listener (h2 in the bind line / ALPN negotiation) are reachable; HTTP/1.x-only setups are unaffected, and no authentication or user interaction is required against an H2 endpoint. Sustained impact depends on the attacker holding many concurrent connections open, since each connection is eventually cleared by 'timeout http-request'; no public exploit code was identified at the time of analysis and there is no KEV confirmation of active exploitation.
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21.
Remote, unauthenticated denial of service in RIOT OS 2023.07 through 2026.07: the nanocoap_fileserver in sys/net/application_layer/nanocoap/fileserver.c ignores the failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. On builds with the non-default nanocoap_token_ext option enabled, a client can send a CoAP request carrying a sufficiently large extended token so that response initialization fails while _get_file()/_get_directory() proceeds with stale response state, eventually hitting the _calc_szx2() assertion (pdu->payload_len > reserve) and aborting the affected service or device task. Exploitation is gated on the token-ext configuration, network reachability of the fileserver, and assertions being compiled in; there is no confidentiality or integrity impact, no public exploit identified at time of analysis, and no fixed release was available as of this review.
Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.13.0 through the fixed releases (4.3.3, 4.2.9, 4.1.14, 4.0.23, 3.13.18), where the JWKS signing-key fetch routine in uaajwt.erl fails to check the HTTP response status code and treats any well-formed HTTP transaction as a success, so a single non-200 response with valid JSON that lacks a 'keys' field wipes all cached signing keys and breaks OAuth2/JWT authentication for every user until the next successful refresh. The vulnerability is remotely reachable and unauthenticated (CVSS:4.0 PR:N / independent CVSS:3.1 PR:N), but exploitation depends on attack requirements being met (AT:P) - the attacker must induce or coincide with an error-returning JWKS response - and the resulting impact is a persistent availability outage (VC:N/VI:N/VA:H in the assessed vector, C:N/I:N/A:H in the independent 3.1 assessment), with no data exposure or code execution. No public exploit code was identified at time of analysis and there is no CISA KEV listing; treat this as a genuine availability threat rather than a top-tier emergency.
Local privilege escalation in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows an attacker who already holds a low-privileged local account to escalate to higher privileges on the host. The flaw is an unchecked return value (CWE-252) in the framework, and successful exploitation yields total technical impact - high confidentiality, integrity, and availability loss - although it requires local access and an existing foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit has been identified at time of analysis, EPSS is a low 0.13% (3rd percentile), and CISA SSVC records Exploitation: none and Automatable: no; a vendor patch is available from Dell.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present.
Permanent image data destruction in Snipe-IT ≤8.6.3 results from unchecked return values on Laravel storage operations in ImageUploadRequest::handleImages(). When any authenticated user submits an image upload while the configured storage backend (S3, local filesystem, NFS) experiences a transient failure, the silently-returned false from Storage::put() is ignored - the prior image is deleted, and the database record is updated to reference a file that was never written. A symmetric defect in deleteExistingImage() compounds the problem by nulling the model's image field even when Storage::delete() fails, orphaning files on disk. The condition affects all image-carrying models routed through this handler and produces unrecoverable data loss requiring manual reconciliation. No public exploit has been identified at time of analysis.
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1.
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.
A truncated HTTP/2 PING frame sent to an HAProxy frontend that accepts HTTP/2 causes the H2 multiplexer to spin in a busy loop, driving worker-thread CPU to saturation and degrading or denying service to legitimate traffic (CVSS 7.5, availability-only). Only deployments with an HTTP/2-enabled listener (h2 in the bind line / ALPN negotiation) are reachable; HTTP/1.x-only setups are unaffected, and no authentication or user interaction is required against an H2 endpoint. Sustained impact depends on the attacker holding many concurrent connections open, since each connection is eventually cleared by 'timeout http-request'; no public exploit code was identified at the time of analysis and there is no KEV confirmation of active exploitation.
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21.
Remote, unauthenticated denial of service in RIOT OS 2023.07 through 2026.07: the nanocoap_fileserver in sys/net/application_layer/nanocoap/fileserver.c ignores the failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. On builds with the non-default nanocoap_token_ext option enabled, a client can send a CoAP request carrying a sufficiently large extended token so that response initialization fails while _get_file()/_get_directory() proceeds with stale response state, eventually hitting the _calc_szx2() assertion (pdu->payload_len > reserve) and aborting the affected service or device task. Exploitation is gated on the token-ext configuration, network reachability of the fileserver, and assertions being compiled in; there is no confidentiality or integrity impact, no public exploit identified at time of analysis, and no fixed release was available as of this review.
Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.13.0 through the fixed releases (4.3.3, 4.2.9, 4.1.14, 4.0.23, 3.13.18), where the JWKS signing-key fetch routine in uaajwt.erl fails to check the HTTP response status code and treats any well-formed HTTP transaction as a success, so a single non-200 response with valid JSON that lacks a 'keys' field wipes all cached signing keys and breaks OAuth2/JWT authentication for every user until the next successful refresh. The vulnerability is remotely reachable and unauthenticated (CVSS:4.0 PR:N / independent CVSS:3.1 PR:N), but exploitation depends on attack requirements being met (AT:P) - the attacker must induce or coincide with an error-returning JWKS response - and the resulting impact is a persistent availability outage (VC:N/VI:N/VA:H in the assessed vector, C:N/I:N/A:H in the independent 3.1 assessment), with no data exposure or code execution. No public exploit code was identified at time of analysis and there is no CISA KEV listing; treat this as a genuine availability threat rather than a top-tier emergency.
Local privilege escalation in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows an attacker who already holds a low-privileged local account to escalate to higher privileges on the host. The flaw is an unchecked return value (CWE-252) in the framework, and successful exploitation yields total technical impact - high confidentiality, integrity, and availability loss - although it requires local access and an existing foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit has been identified at time of analysis, EPSS is a low 0.13% (3rd percentile), and CISA SSVC records Exploitation: none and Automatable: no; a vendor patch is available from Dell.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present.
Permanent image data destruction in Snipe-IT ≤8.6.3 results from unchecked return values on Laravel storage operations in ImageUploadRequest::handleImages(). When any authenticated user submits an image upload while the configured storage backend (S3, local filesystem, NFS) experiences a transient failure, the silently-returned false from Storage::put() is ignored - the prior image is deleted, and the database record is updated to reference a file that was never written. A symmetric defect in deleteExistingImage() compounds the problem by nulling the model's image field even when Storage::delete() fails, orphaning files on disk. The condition affects all image-carrying models routed through this handler and produces unrecoverable data loss requiring manual reconciliation. No public exploit has been identified at time of analysis.
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1.
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.