Monthly
GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.
Null pointer dereference in Open5GS versions up to 2.7.7 allows network-accessible low-privileged attackers to crash the AMF (Access and Mobility Management Function) by sending crafted SBI messages with missing required body fields to the N1/N2 Transfer Endpoint. The vulnerability exists across multiple code paths in src/amf/namf-handler.c, including UE context transfer, registration status update, and UE MM context list decoding, where pointers were dereferenced without null guards. Successful exploitation causes AMF process termination, denying 5G mobility and UE registration services to all subscribers managed by the affected AMF instance. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Denial of service via improper resource shutdown in Magma 1.9.0's gNB Termination Handler allows remote low-privileged attackers to disrupt or crash the AMF's NGAP processing of 5G base station connections. The flaw in tasks/ngap/ngap_amf.c stems from CWE-404 (improper resource release), producing availability impact against the vulnerable system with no confidentiality or integrity consequence. A public proof-of-concept exploit exists per the referenced GitHub issue #16019, though CISA has not confirmed active exploitation.
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV, but the patch is available from the vendor.
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.
Null pointer dereference in Open5GS versions up to 2.7.7 allows network-accessible low-privileged attackers to crash the AMF (Access and Mobility Management Function) by sending crafted SBI messages with missing required body fields to the N1/N2 Transfer Endpoint. The vulnerability exists across multiple code paths in src/amf/namf-handler.c, including UE context transfer, registration status update, and UE MM context list decoding, where pointers were dereferenced without null guards. Successful exploitation causes AMF process termination, denying 5G mobility and UE registration services to all subscribers managed by the affected AMF instance. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Denial of service via improper resource shutdown in Magma 1.9.0's gNB Termination Handler allows remote low-privileged attackers to disrupt or crash the AMF's NGAP processing of 5G base station connections. The flaw in tasks/ngap/ngap_amf.c stems from CWE-404 (improper resource release), producing availability impact against the vulnerable system with no confidentiality or integrity consequence. A public proof-of-concept exploit exists per the referenced GitHub issue #16019, though CISA has not confirmed active exploitation.
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV, but the patch is available from the vendor.
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.