Monthly
Unfair, non-queued acquisition of Xen's system-wide sysctl operation lock lets a domain with hypercall access starve competing management sysctl operations, potentially blocking administrative control-plane work on the hypervisor. The realistic exposure is narrow: in a default configuration only the trusted control domain (dom0) can issue these hypercalls, and the meaningful risk appears when XSM/Flask is enabled and some sysctl operations are delegated to a less-privileged domain, where the lock is taken before the XSM permission check. Independent assessment rates this as availability-only with local, low-privilege prerequisites (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), which is materially lower than NVD's 8.8 high/high/high vector; EPSS is low at 0.23% (14th percentile), SSVC reports no exploitation and no automatable exploitation, and no public exploit has been identified at time of analysis. A companion issue for platform operations with the same lock-ordering defect is tracked separately as CVE-2026-62427.
OpenVPN on Windows (versions 2.0.0-2.6.22 and 2.7_alpha1-2.7.6) creates the --service exit event and netsh.exe guard semaphore with a NULL Discretionary Access Control List, granting any local process unrestricted access to these named synchronization objects. A low-privileged local user can acquire and hold the world-accessible semaphore indefinitely or signal the exit event, disrupting or terminating all other users' OpenVPN sessions on the same Windows host. The issue is Windows-only, affects only deployments not using the Interactive Service (iservice), and has been resolved in v2.7.7; no public exploit code has been identified.
MongoDB server's resource locking mechanism can cause unintended collisions between collections due to improper internal encoding, leading to service denial of availability. Authenticated users can trigger this condition to disrupt database operations across affected collections without requiring user interaction. No patch is currently available to remediate this vulnerability.
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unfair, non-queued acquisition of Xen's system-wide sysctl operation lock lets a domain with hypercall access starve competing management sysctl operations, potentially blocking administrative control-plane work on the hypervisor. The realistic exposure is narrow: in a default configuration only the trusted control domain (dom0) can issue these hypercalls, and the meaningful risk appears when XSM/Flask is enabled and some sysctl operations are delegated to a less-privileged domain, where the lock is taken before the XSM permission check. Independent assessment rates this as availability-only with local, low-privilege prerequisites (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), which is materially lower than NVD's 8.8 high/high/high vector; EPSS is low at 0.23% (14th percentile), SSVC reports no exploitation and no automatable exploitation, and no public exploit has been identified at time of analysis. A companion issue for platform operations with the same lock-ordering defect is tracked separately as CVE-2026-62427.
OpenVPN on Windows (versions 2.0.0-2.6.22 and 2.7_alpha1-2.7.6) creates the --service exit event and netsh.exe guard semaphore with a NULL Discretionary Access Control List, granting any local process unrestricted access to these named synchronization objects. A low-privileged local user can acquire and hold the world-accessible semaphore indefinitely or signal the exit event, disrupting or terminating all other users' OpenVPN sessions on the same Windows host. The issue is Windows-only, affects only deployments not using the Interactive Service (iservice), and has been resolved in v2.7.7; no public exploit code has been identified.
MongoDB server's resource locking mechanism can cause unintended collisions between collections due to improper internal encoding, leading to service denial of availability. Authenticated users can trigger this condition to disrupt database operations across affected collections without requiring user interaction. No patch is currently available to remediate this vulnerability.
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.