Monthly
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
ImageMagick builds prior to 7.1.2-31 and 6.9.13-56 contain an invalid memory free in the MVG (Magick Vector Graphics) decoder that aborts or crashes the process when a crafted image is parsed. Attackers reach it by supplying an image carrying malicious MVG drawing primitives to any application that renders, converts, or thumbnails untrusted images; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis, CISA SSVC records Exploitation 'none' and Automatable 'no', and EPSS sits at 0.40% (32nd percentile), so the flaw is primarily a realistic denial-of-service risk for image-processing pipelines rather than an imminent attack vector.
Ubuntu Linux is the only product implicated by the available reporting for CVE-2026-95311, a record attributed to the Ubuntu vendor security team, but the vulnerability description is unpublished and no CVSS score or vector, CWE classification, CPE identifier, EPSS estimate, or CISA KEV entry accompanies it, so the affected component, version range, and attack vector cannot be stated. No public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation. Risk cannot be meaningfully assessed from the provided data; the only actionable intelligence is the vendor attribution, which indicates Canonical is coordinating the record and that the Ubuntu Security Notices feed and the upstream advisory should be monitored for the eventual disclosure.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
The Windows Ancillary Function Driver for WinSock contains an improper memory deallocation vulnerability (CWE-590) that allows authenticated local attackers to achieve privilege escalation on affected Windows 10 and Windows Server 2019 systems. An attacker with local user privileges can exploit this flaw to gain SYSTEM-level access without user interaction. No patch is currently available for this vulnerability.
Remote, unauthenticated clients can crash libIEC61850-based MMS servers running versions prior to 1.6.2 by writing an RptID value longer than 129 bytes to a report control block and then triggering report serialization via General Interrogation (GI). The oversized identifier overflows a fixed 130-byte stack buffer that is later wrapped as a temporary MmsValue and handed to MmsValue_setVisibleString, whose resize path attempts to free non-heap (stack) memory - an invalid free that terminates the server process. Impact is availability-only (CVSS 5.3, A:L) with no code execution, data disclosure, or integrity effect, and no public exploit has been identified at time of analysis; the issue is fixed in upstream version 1.6.2.
Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical.
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a malformed Windows PE file. Five Gen Digital products share a common virus definition update stream - Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux - making all simultaneously vulnerable until the shared definition stream reaches build VPS 25022500. No public exploit has been identified at time of analysis; the impact is limited to a Denial-of-Service of the antivirus process with no confidentiality or integrity loss, and the CVSS score of 5.5 reflects the local, user-interaction-dependent nature of the attack.
Ubuntu Linux kernels 6.8, 6.17, and 7.0 ship Ubuntu-specific AppArmor SAUCE patches that incorrectly call kfree() on a pointer never allocated via kmalloc(), while simultaneously leaking the legitimately allocated memory. Any unprivileged local user can trigger this kernel memory management flaw, corrupting slab allocator metadata and driving the system toward resource exhaustion or instability. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, CVSS rates availability impact as High given the potential for kernel-level denial of service.
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
ImageMagick builds prior to 7.1.2-31 and 6.9.13-56 contain an invalid memory free in the MVG (Magick Vector Graphics) decoder that aborts or crashes the process when a crafted image is parsed. Attackers reach it by supplying an image carrying malicious MVG drawing primitives to any application that renders, converts, or thumbnails untrusted images; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis, CISA SSVC records Exploitation 'none' and Automatable 'no', and EPSS sits at 0.40% (32nd percentile), so the flaw is primarily a realistic denial-of-service risk for image-processing pipelines rather than an imminent attack vector.
Ubuntu Linux is the only product implicated by the available reporting for CVE-2026-95311, a record attributed to the Ubuntu vendor security team, but the vulnerability description is unpublished and no CVSS score or vector, CWE classification, CPE identifier, EPSS estimate, or CISA KEV entry accompanies it, so the affected component, version range, and attack vector cannot be stated. No public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation. Risk cannot be meaningfully assessed from the provided data; the only actionable intelligence is the vendor attribution, which indicates Canonical is coordinating the record and that the Ubuntu Security Notices feed and the upstream advisory should be monitored for the eventual disclosure.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
The Windows Ancillary Function Driver for WinSock contains an improper memory deallocation vulnerability (CWE-590) that allows authenticated local attackers to achieve privilege escalation on affected Windows 10 and Windows Server 2019 systems. An attacker with local user privileges can exploit this flaw to gain SYSTEM-level access without user interaction. No patch is currently available for this vulnerability.
Remote, unauthenticated clients can crash libIEC61850-based MMS servers running versions prior to 1.6.2 by writing an RptID value longer than 129 bytes to a report control block and then triggering report serialization via General Interrogation (GI). The oversized identifier overflows a fixed 130-byte stack buffer that is later wrapped as a temporary MmsValue and handed to MmsValue_setVisibleString, whose resize path attempts to free non-heap (stack) memory - an invalid free that terminates the server process. Impact is availability-only (CVSS 5.3, A:L) with no code execution, data disclosure, or integrity effect, and no public exploit has been identified at time of analysis; the issue is fixed in upstream version 1.6.2.
Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical.
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a malformed Windows PE file. Five Gen Digital products share a common virus definition update stream - Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux - making all simultaneously vulnerable until the shared definition stream reaches build VPS 25022500. No public exploit has been identified at time of analysis; the impact is limited to a Denial-of-Service of the antivirus process with no confidentiality or integrity loss, and the CVSS score of 5.5 reflects the local, user-interaction-dependent nature of the attack.
Ubuntu Linux kernels 6.8, 6.17, and 7.0 ship Ubuntu-specific AppArmor SAUCE patches that incorrectly call kfree() on a pointer never allocated via kmalloc(), while simultaneously leaking the legitimately allocated memory. Any unprivileged local user can trigger this kernel memory management flaw, corrupting slab allocator metadata and driving the system toward resource exhaustion or instability. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, CVSS rates availability impact as High given the potential for kernel-level denial of service.
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.