Monthly
Remote code execution can result in IBM Langflow OSS 1.0.0 through 1.12.2 through a dependency confusion weakness, where the product resolves an expected dependency from a public package registry instead of the intended trusted source. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker with no user interaction required, and the unpatched severity is rated 9.8; however, our independent assessment lowers the attack complexity to AC:H because successful exploitation depends on the attacker knowing or guessing the exact dependency name and on the victim's resolver preferring an attacker-published public package over the legitimate one, typically during an install, build, or import event rather than against a running service. There is no confirmed active exploitation (CISA KEV does not list this CVE), SSVC records Exploitation: none and Automatable: no, no public exploit code has been identified at time of analysis, and EPSS is only 0.68% (51st percentile), so the practical near-term risk is materially lower than the 9.8 headline suggests. A vendor patch is available per the IBM advisory.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.
Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Modules (all versions) allows unauthenticated remote attackers to halt the module's communication function by flooding its Ethernet port with packets. The high packet rate overwhelms internal anomaly-detection processing and stops communications - a critical impact for the industrial control environments these PLCs operate in. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects high availability impact in operational technology contexts.
Concurrent constrained-decoding traffic against vLLM servers running versions before 0.31.0 can leave a stale token allowlist in a recycled batch slot, so a victim's unrestricted generation request is silently constrained to the attacker's token set. The flaw is in InputBatch.condense(), which recycles finished request slots without clearing allowed_token_ids; remote unauthenticated attackers who can reach the generation API, including the unauthenticated /invocations endpoint, can trigger it by submitting many concurrent constrained requests while a race with slot reuse is won. Impact is integrity-only - the victim's output is degraded or steered, but no victim data is read - and success is timing- and load-dependent (CVSS AC:H with attack requirement AT:P). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is fixed in vLLM 0.31.0.
QUIC-enabled servers running OpenSSL 3.5.0 through 3.5.8, 3.6.0 through 3.6.4, and 4.0.0 through 4.0.2 can be induced to over-account the amplification credit granted to an unvalidated client address, so the library may emit more reflected UDP traffic toward a spoofed source than QUIC's anti-amplification rules permit. The flaw sits in the pre-address-validation path of the QUIC stack, meaning unauthenticated remote attackers who can spoof source IPs need no credentials or user interaction, though the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) and score of 3.7 reflect the narrow timing and traffic conditions required and a bounded impact limited to traffic amplification rather than code execution or data exposure. No public exploit code is identified at time of analysis, it is not confirmed actively exploited (no CISA KEV listing), and CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
CAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM)-enforced immobilizer, enabling vehicle operation without legitimate anti-theft deactivation. An attacker within physical or adjacent proximity drives the WCM's CAN controller into bus-off state by incrementing its transmit error counter past the threshold, permanently silencing the WCM's periodic shutdown command. Because peer ECUs treat WCM silence as benign rather than a security event - a fail-open design - the motorcycle becomes fully operable as though the immobilizer were properly unlocked. No public exploit code has been identified at time of analysis; ASRG is withholding full protocol details pending vendor remediation, reported under CVE-2026-49316.
Resolution performance degradation in NLnet Labs Unbound 1.25.0 and earlier allows an unauthenticated remote attacker - who also controls a malicious or slow authoritative nameserver - to subvert the jostle logic designed to evict stalled queries, ultimately causing denial of resolution service. The jostle mechanism, which activates when the num-queries-per-thread limit is reached, is bypassed because retransmitted duplicate queries reset the aging timestamp to the latest duplicate rather than preserving the original query start time, preventing aged queries from being correctly identified and replaced. No public exploit has been identified at time of analysis; however, the vendor has confirmed the issue and released a patch in version 1.25.1.
Remote code execution can result in IBM Langflow OSS 1.0.0 through 1.12.2 through a dependency confusion weakness, where the product resolves an expected dependency from a public package registry instead of the intended trusted source. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker with no user interaction required, and the unpatched severity is rated 9.8; however, our independent assessment lowers the attack complexity to AC:H because successful exploitation depends on the attacker knowing or guessing the exact dependency name and on the victim's resolver preferring an attacker-published public package over the legitimate one, typically during an install, build, or import event rather than against a running service. There is no confirmed active exploitation (CISA KEV does not list this CVE), SSVC records Exploitation: none and Automatable: no, no public exploit code has been identified at time of analysis, and EPSS is only 0.68% (51st percentile), so the practical near-term risk is materially lower than the 9.8 headline suggests. A vendor patch is available per the IBM advisory.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.
Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Modules (all versions) allows unauthenticated remote attackers to halt the module's communication function by flooding its Ethernet port with packets. The high packet rate overwhelms internal anomaly-detection processing and stops communications - a critical impact for the industrial control environments these PLCs operate in. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects high availability impact in operational technology contexts.
Concurrent constrained-decoding traffic against vLLM servers running versions before 0.31.0 can leave a stale token allowlist in a recycled batch slot, so a victim's unrestricted generation request is silently constrained to the attacker's token set. The flaw is in InputBatch.condense(), which recycles finished request slots without clearing allowed_token_ids; remote unauthenticated attackers who can reach the generation API, including the unauthenticated /invocations endpoint, can trigger it by submitting many concurrent constrained requests while a race with slot reuse is won. Impact is integrity-only - the victim's output is degraded or steered, but no victim data is read - and success is timing- and load-dependent (CVSS AC:H with attack requirement AT:P). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is fixed in vLLM 0.31.0.
QUIC-enabled servers running OpenSSL 3.5.0 through 3.5.8, 3.6.0 through 3.6.4, and 4.0.0 through 4.0.2 can be induced to over-account the amplification credit granted to an unvalidated client address, so the library may emit more reflected UDP traffic toward a spoofed source than QUIC's anti-amplification rules permit. The flaw sits in the pre-address-validation path of the QUIC stack, meaning unauthenticated remote attackers who can spoof source IPs need no credentials or user interaction, though the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) and score of 3.7 reflect the narrow timing and traffic conditions required and a bounded impact limited to traffic amplification rather than code execution or data exposure. No public exploit code is identified at time of analysis, it is not confirmed actively exploited (no CISA KEV listing), and CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
CAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM)-enforced immobilizer, enabling vehicle operation without legitimate anti-theft deactivation. An attacker within physical or adjacent proximity drives the WCM's CAN controller into bus-off state by incrementing its transmit error counter past the threshold, permanently silencing the WCM's periodic shutdown command. Because peer ECUs treat WCM silence as benign rather than a security event - a fail-open design - the motorcycle becomes fully operable as though the immobilizer were properly unlocked. No public exploit code has been identified at time of analysis; ASRG is withholding full protocol details pending vendor remediation, reported under CVE-2026-49316.
Resolution performance degradation in NLnet Labs Unbound 1.25.0 and earlier allows an unauthenticated remote attacker - who also controls a malicious or slow authoritative nameserver - to subvert the jostle logic designed to evict stalled queries, ultimately causing denial of resolution service. The jostle mechanism, which activates when the num-queries-per-thread limit is reached, is bypassed because retransmitted duplicate queries reset the aging timestamp to the latest duplicate rather than preserving the original query start time, preventing aged queries from being correctly identified and replaced. No public exploit has been identified at time of analysis; however, the vendor has confirmed the issue and released a patch in version 1.25.1.