Monthly
Crafted HTTP requests sent to the HTTPS management (GUI) interface of FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 can stall that interface through improper locking, denying administrative access to the device. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the attack is remote, low-complexity, requires no authentication and no user interaction, but impact is confined to availability of the management plane (A:H; C:N/I:N) rather than traffic forwarding. Exploitation is not confirmed - SSVC records exploitation as none, EPSS is 0.28% (21st percentile) and no public exploit or PoC reference appears in the provided sources - so risk is best characterised as a moderate, exposure-dependent availability issue; the decisive factor is whether the HTTPS admin interface is reachable from untrusted networks.
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaadin-server-mpr-jakarta 8.18.0 through 8.32.1): a request carrying a non-numeric v-uiId parameter makes Integer.parseInt throw inside VaadinService.requestEnd() while the session lock is held, so the lock is never released and the serving thread returns to the pool still owning it. Every subsequent request for that session then blocks indefinitely in VaadinService.lockSession(), and repeating the request exhausts the container thread pool and takes the application down. Exploitation requires no credentials - a session cookie from a single initial request is sufficient - and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable over HTTP by any client.
Authenticated users who are able to open a pull request from a fork can cancel trusted, in-progress Gitea Actions runs in the base repository when those runs share a workflow-level concurrency group with cancel-in-progress enabled, because the cancellation logic does not check whether the newer run still needs approval before terminating the older ones. The attacker runs no code and gains no data access, but on self-hosted runners the interruption can abort an in-flight deployment and leave partial state behind. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), consistent with a targeted, configuration-dependent CI-disruption issue rather than a broad default-config exposure.
Permanent deadlock of the alerting subsystem in Nezha Dashboard 1.8.0 through 2.3.12 allows any authenticated non-admin member to disable monitoring notifications by issuing four crafted notification API calls, and continued blocking requests can then exhaust server memory. The flaw is an improper locking issue (CWE-667) in which a mutex is unlocked non-deferred on a nil-map panic path, leaving the lock permanently held. Exploitation requires a valid low-privilege account (the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, so this represents a genuine but bounded availability risk rather than a critical priority.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.
Crafted HTTP requests sent to the HTTPS management (GUI) interface of FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 can stall that interface through improper locking, denying administrative access to the device. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the attack is remote, low-complexity, requires no authentication and no user interaction, but impact is confined to availability of the management plane (A:H; C:N/I:N) rather than traffic forwarding. Exploitation is not confirmed - SSVC records exploitation as none, EPSS is 0.28% (21st percentile) and no public exploit or PoC reference appears in the provided sources - so risk is best characterised as a moderate, exposure-dependent availability issue; the decisive factor is whether the HTTPS admin interface is reachable from untrusted networks.
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaadin-server-mpr-jakarta 8.18.0 through 8.32.1): a request carrying a non-numeric v-uiId parameter makes Integer.parseInt throw inside VaadinService.requestEnd() while the session lock is held, so the lock is never released and the serving thread returns to the pool still owning it. Every subsequent request for that session then blocks indefinitely in VaadinService.lockSession(), and repeating the request exhausts the container thread pool and takes the application down. Exploitation requires no credentials - a session cookie from a single initial request is sufficient - and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable over HTTP by any client.
Authenticated users who are able to open a pull request from a fork can cancel trusted, in-progress Gitea Actions runs in the base repository when those runs share a workflow-level concurrency group with cancel-in-progress enabled, because the cancellation logic does not check whether the newer run still needs approval before terminating the older ones. The attacker runs no code and gains no data access, but on self-hosted runners the interruption can abort an in-flight deployment and leave partial state behind. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), consistent with a targeted, configuration-dependent CI-disruption issue rather than a broad default-config exposure.
Permanent deadlock of the alerting subsystem in Nezha Dashboard 1.8.0 through 2.3.12 allows any authenticated non-admin member to disable monitoring notifications by issuing four crafted notification API calls, and continued blocking requests can then exhaust server memory. The flaw is an improper locking issue (CWE-667) in which a mutex is unlocked non-deferred on a nil-map panic path, leaving the lock permanently held. Exploitation requires a valid low-privilege account (the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, so this represents a genuine but bounded availability risk rather than a critical priority.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.