Monthly
Remote unauthenticated attackers can cause a consensus divergence in Zcash Zebra nodes (zebrad 4.5.0 and zebra-script 7.0.0) by broadcasting P2SH spends that use low-threshold multisig redeem scripts, causing affected Zebra nodes to reject a block that zcashd accepts and stall off the chain, resulting in a denial of service. The vulnerability stems from incorrect signature operation counting that overcounts CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops, inflating the MAX_BLOCK_SIGOPS count. No public exploit code has been identified at time of analysis, and no authentication or user interaction is required per the CVSS vector PR:N/UI:N.
Nested AMD SVM virtualization in Linux kernel KVM incorrectly handles VMLOAD/VMSAVE emulation, allowing local privileged attackers in L2 guests to read and write L1 guest state, potentially escalating privileges or causing denial of service. This affects kernels since commit cc3ed80ae69f (v5.13+) and has been patched in stable releases 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and mainline 7.0. With 7.9 CVSS (HIGH severity) but only 0.02% EPSS, this is a lower-probability threat requiring local authenticated access to nested virtualization environments. No public exploit or active exploitation (KEV) identified at time of analysis.
A business logic error in Tanium Threat Response (CWE-628) lets a remote attacker who already holds a valid low-privileged account cause a limited integrity impact; the CVSS 4.3 vector rates confidentiality and availability as unaffected. Tanium published the issue under advisory TAN-2026-081, and no public exploit code or CISA KEV entry was identified at time of analysis. The authentication prerequisite (PR:L) is the main limiting factor, keeping this at moderate rather than urgent priority.
CVE-2025-0325 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote unauthenticated attackers can cause a consensus divergence in Zcash Zebra nodes (zebrad 4.5.0 and zebra-script 7.0.0) by broadcasting P2SH spends that use low-threshold multisig redeem scripts, causing affected Zebra nodes to reject a block that zcashd accepts and stall off the chain, resulting in a denial of service. The vulnerability stems from incorrect signature operation counting that overcounts CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops, inflating the MAX_BLOCK_SIGOPS count. No public exploit code has been identified at time of analysis, and no authentication or user interaction is required per the CVSS vector PR:N/UI:N.
Nested AMD SVM virtualization in Linux kernel KVM incorrectly handles VMLOAD/VMSAVE emulation, allowing local privileged attackers in L2 guests to read and write L1 guest state, potentially escalating privileges or causing denial of service. This affects kernels since commit cc3ed80ae69f (v5.13+) and has been patched in stable releases 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and mainline 7.0. With 7.9 CVSS (HIGH severity) but only 0.02% EPSS, this is a lower-probability threat requiring local authenticated access to nested virtualization environments. No public exploit or active exploitation (KEV) identified at time of analysis.
A business logic error in Tanium Threat Response (CWE-628) lets a remote attacker who already holds a valid low-privileged account cause a limited integrity impact; the CVSS 4.3 vector rates confidentiality and availability as unaffected. Tanium published the issue under advisory TAN-2026-081, and no public exploit code or CISA KEV entry was identified at time of analysis. The authentication prerequisite (PR:L) is the main limiting factor, keeping this at moderate rather than urgent priority.
CVE-2025-0325 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.