Monthly
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Squid proxy versions prior to 7.5 contain use-after-free and premature resource release vulnerabilities in ICP (Internet Cache Protocol) traffic handling that enable reliable, repeatable denial of service attacks. Remote attackers can exploit these memory safety bugs to crash the Squid service by sending specially crafted ICP packets, affecting deployments that have explicitly enabled ICP support via non-zero icp_port configuration. While no CVSS score or EPSS value is currently published, the vulnerability is confirmed by vendor advisory and includes a public patch commit, indicating moderate to high real-world risk for affected deployments.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
Denial of service in the OpenVPN Data Channel Offload driver for Windows (ovpn-dco-win) allows a local attacker to deadlock the kernel driver with a crafted write to the ovpn-dco device, leaving the host unresponsive and typically requiring a reboot to recover. Windows endpoints running ovpn-dco-win 0.6.5 through 1.3.5 or 2.4.0 through 2.8.7 are affected; the assessed vector (CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates no privileges are required from the local vantage point, though device-object access controls may in practice restrict who can reach the write path, and there is no confidentiality or integrity impact, no code execution, and no privilege gain. No public exploit code has been identified at time of analysis and the failure mode is availability-only, making this a modest-priority local DoS rather than a remote or wormable issue.
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.
Heap use-after-free in Unbound's RPZ (Response Policy Zone) subsystem crashes the DNS resolver under a specific race condition affecting multi-threaded deployments. Versions 1.14.0 through 1.25.0 are affected when an RPZ zone with 'rpz-nsip' or 'rpz-nsdname' triggers is served via XFR (zone transfer) and a simultaneous read occurs in another thread. The crash is remotely triggerable by timing a DNS query against an in-progress XFR, but requires multiple co-occurring non-default conditions; no public exploit exists and no active exploitation has been confirmed.
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Unauthenticated remote attackers can delete data in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93, causing denial-of-service conditions through improper resource locking. The flaw is rated CVSS 9.3 with high integrity and availability impact but no confidentiality impact, and no public exploit has been identified at time of analysis (EPSS 0.28%, 19th percentile). Exposure is limited in practice to controllers reachable from the attacker’s network, typically OT/plant segments rather than the public internet.
A flaw was found in the Linux kernel's ksmbd component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Squid proxy versions prior to 7.5 contain use-after-free and premature resource release vulnerabilities in ICP (Internet Cache Protocol) traffic handling that enable reliable, repeatable denial of service attacks. Remote attackers can exploit these memory safety bugs to crash the Squid service by sending specially crafted ICP packets, affecting deployments that have explicitly enabled ICP support via non-zero icp_port configuration. While no CVSS score or EPSS value is currently published, the vulnerability is confirmed by vendor advisory and includes a public patch commit, indicating moderate to high real-world risk for affected deployments.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
Denial of service in the OpenVPN Data Channel Offload driver for Windows (ovpn-dco-win) allows a local attacker to deadlock the kernel driver with a crafted write to the ovpn-dco device, leaving the host unresponsive and typically requiring a reboot to recover. Windows endpoints running ovpn-dco-win 0.6.5 through 1.3.5 or 2.4.0 through 2.8.7 are affected; the assessed vector (CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates no privileges are required from the local vantage point, though device-object access controls may in practice restrict who can reach the write path, and there is no confidentiality or integrity impact, no code execution, and no privilege gain. No public exploit code has been identified at time of analysis and the failure mode is availability-only, making this a modest-priority local DoS rather than a remote or wormable issue.
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.
Heap use-after-free in Unbound's RPZ (Response Policy Zone) subsystem crashes the DNS resolver under a specific race condition affecting multi-threaded deployments. Versions 1.14.0 through 1.25.0 are affected when an RPZ zone with 'rpz-nsip' or 'rpz-nsdname' triggers is served via XFR (zone transfer) and a simultaneous read occurs in another thread. The crash is remotely triggerable by timing a DNS query against an in-progress XFR, but requires multiple co-occurring non-default conditions; no public exploit exists and no active exploitation has been confirmed.
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Unauthenticated remote attackers can delete data in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93, causing denial-of-service conditions through improper resource locking. The flaw is rated CVSS 9.3 with high integrity and availability impact but no confidentiality impact, and no public exploit has been identified at time of analysis (EPSS 0.28%, 19th percentile). Exposure is limited in practice to controllers reachable from the attacker’s network, typically OT/plant segments rather than the public internet.
A flaw was found in the Linux kernel's ksmbd component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable.