Monthly
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
OpenVPN on Windows (versions 2.0.0-2.6.22 and 2.7_alpha1-2.7.6) creates the --service exit event and netsh.exe guard semaphore with a NULL Discretionary Access Control List, granting any local process unrestricted access to these named synchronization objects. A low-privileged local user can acquire and hold the world-accessible semaphore indefinitely or signal the exit event, disrupting or terminating all other users' OpenVPN sessions on the same Windows host. The issue is Windows-only, affects only deployments not using the Interactive Service (iservice), and has been resolved in v2.7.7; no public exploit code has been identified.
MongoDB server's resource locking mechanism can cause unintended collisions between collections due to improper internal encoding, leading to service denial of availability. Authenticated users can trigger this condition to disrupt database operations across affected collections without requiring user interaction. No patch is currently available to remediate this vulnerability.
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
OpenVPN on Windows (versions 2.0.0-2.6.22 and 2.7_alpha1-2.7.6) creates the --service exit event and netsh.exe guard semaphore with a NULL Discretionary Access Control List, granting any local process unrestricted access to these named synchronization objects. A low-privileged local user can acquire and hold the world-accessible semaphore indefinitely or signal the exit event, disrupting or terminating all other users' OpenVPN sessions on the same Windows host. The issue is Windows-only, affects only deployments not using the Interactive Service (iservice), and has been resolved in v2.7.7; no public exploit code has been identified.
MongoDB server's resource locking mechanism can cause unintended collisions between collections due to improper internal encoding, leading to service denial of availability. Authenticated users can trigger this condition to disrupt database operations across affected collections without requiring user interaction. No patch is currently available to remediate this vulnerability.
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.