Monthly
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Use-after-free crash in Tor's conflux traffic-splitting code allows a remote unauthenticated attacker (per CVSS:3.1/AV:N/PR:N) to crash a Tor relay or client by triggering a CONFLUX_SWITCH cell send failure. The root cause is an unchecked return value from relay_send_command_from_edge(): when the send fails, the circuit is torn down and the leg freed via cfx_del_leg(), but the caller proceeds to write to that now-freed memory, causing a NULL write-after-free and process crash. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the high-complexity exploitation bar (AC:H) is the primary limiting factor rather than any authentication gate.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
Heap use-after-free in ImageMagick before 7.1.2-26 allows unauthenticated remote attackers to crash applications processing attacker-supplied image files by embedding specially crafted XMP profile data. The root cause is a missing null check (CWE-252) during XMP metadata parsing, which triggers invalid memory access and results in a denial-of-service condition. No public exploit code and no CISA KEV listing exist at time of analysis, though ImageMagick's deep integration into web image pipelines means a single malicious upload can disrupt server-side processing at scale.
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted tar archive opened in streaming mode (mode='r|'). The seek() routine fails to detect EOF and keeps requesting bufsize reads of empty data when a TarInfo header declares a size far larger than the actual stream, exhausting CPU on any Python service that parses untrusted tar streams. No public exploit identified at time of analysis, but the upstream fix and a reproducer test case are both published on GitHub.
Remote denial-of-service vulnerability in Nimiq full nodes allows unauthenticated attackers to crash nodes by publishing malformed Kademlia DHT records with incorrect Ed25519 signature lengths. The vulnerability triggers a panic in the Ed25519 signature verification code when processing DHT records with signatures not exactly 64 bytes. Vendor-released patch: v1.4.0.
Arbitrary code execution and denial of service in AMD Platform Management Framework (PMF) affects Ryzen 7035, 7040, 8040 mobile processors and Ryzen Embedded 8000 series. A local authenticated attacker exploiting an unchecked return value vulnerability can write to arbitrary memory locations, potentially escalating privileges from low to high integrity across system boundaries. The CVSS 4.0 score of 7.1 reflects local attack vector with low complexity but requires specific attack timing conditions (AT:P), though the cross-scope impact (S:H) and high confidentiality/integrity impact to subsequent systems elevate real-world risk for enterprise environments with AMD mobile processors.
Local attackers with low-privilege credentials can exploit unchecked return value handling in AMD Platform Management Framework (PMF) to read or write arbitrary memory addresses across multiple AMD Ryzen processor families (6000, 7000, 8000 series). This CWE-252 flaw enables privilege escalation to kernel level, compromising system confidentiality and availability with high impact across both virtualized and physical contexts. AMD has released security bulletin AMD-SB-4015 addressing the vulnerability. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and local privilege requirement (PR:L) suggest exploitation is technically straightforward for attackers with initial system access.
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when processing specially crafted requests against virtual servers with active security policies. Undisclosed malformed requests cause the bd process to terminate, disrupting service availability. Remote unauthenticated attackers can exploit this with low complexity (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) achieving high availability impact (CVSS 7.5). EPSS data not provided, no active exploitation confirmed via CISA KEV at time of analysis. Vendor patch available per F5 advisory K000160727.
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Use-after-free crash in Tor's conflux traffic-splitting code allows a remote unauthenticated attacker (per CVSS:3.1/AV:N/PR:N) to crash a Tor relay or client by triggering a CONFLUX_SWITCH cell send failure. The root cause is an unchecked return value from relay_send_command_from_edge(): when the send fails, the circuit is torn down and the leg freed via cfx_del_leg(), but the caller proceeds to write to that now-freed memory, causing a NULL write-after-free and process crash. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the high-complexity exploitation bar (AC:H) is the primary limiting factor rather than any authentication gate.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
Heap use-after-free in ImageMagick before 7.1.2-26 allows unauthenticated remote attackers to crash applications processing attacker-supplied image files by embedding specially crafted XMP profile data. The root cause is a missing null check (CWE-252) during XMP metadata parsing, which triggers invalid memory access and results in a denial-of-service condition. No public exploit code and no CISA KEV listing exist at time of analysis, though ImageMagick's deep integration into web image pipelines means a single malicious upload can disrupt server-side processing at scale.
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted tar archive opened in streaming mode (mode='r|'). The seek() routine fails to detect EOF and keeps requesting bufsize reads of empty data when a TarInfo header declares a size far larger than the actual stream, exhausting CPU on any Python service that parses untrusted tar streams. No public exploit identified at time of analysis, but the upstream fix and a reproducer test case are both published on GitHub.
Remote denial-of-service vulnerability in Nimiq full nodes allows unauthenticated attackers to crash nodes by publishing malformed Kademlia DHT records with incorrect Ed25519 signature lengths. The vulnerability triggers a panic in the Ed25519 signature verification code when processing DHT records with signatures not exactly 64 bytes. Vendor-released patch: v1.4.0.
Arbitrary code execution and denial of service in AMD Platform Management Framework (PMF) affects Ryzen 7035, 7040, 8040 mobile processors and Ryzen Embedded 8000 series. A local authenticated attacker exploiting an unchecked return value vulnerability can write to arbitrary memory locations, potentially escalating privileges from low to high integrity across system boundaries. The CVSS 4.0 score of 7.1 reflects local attack vector with low complexity but requires specific attack timing conditions (AT:P), though the cross-scope impact (S:H) and high confidentiality/integrity impact to subsequent systems elevate real-world risk for enterprise environments with AMD mobile processors.
Local attackers with low-privilege credentials can exploit unchecked return value handling in AMD Platform Management Framework (PMF) to read or write arbitrary memory addresses across multiple AMD Ryzen processor families (6000, 7000, 8000 series). This CWE-252 flaw enables privilege escalation to kernel level, compromising system confidentiality and availability with high impact across both virtualized and physical contexts. AMD has released security bulletin AMD-SB-4015 addressing the vulnerability. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and local privilege requirement (PR:L) suggest exploitation is technically straightforward for attackers with initial system access.
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when processing specially crafted requests against virtual servers with active security policies. Undisclosed malformed requests cause the bd process to terminate, disrupting service availability. Remote unauthenticated attackers can exploit this with low complexity (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) achieving high availability impact (CVSS 7.5). EPSS data not provided, no active exploitation confirmed via CISA KEV at time of analysis. Vendor patch available per F5 advisory K000160727.