Monthly
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Optimizer miscompilation in Vyper 0.3.8 through 0.5.0b1 can silently replace a ternary branch expression of the form (msg.value | K) or (len(msg.data) | K) with the constant 1 under default -O gas or -O codesize, corrupting contract logic and potentially locking funds. Only contracts containing that exact OR-in-ternary construct and compiled with an affected version are exposed; the flaw is a compiler-correctness issue rather than a runtime memory-safety bug. No public exploit code was identified at time of analysis, and risk is highly conditional on deployed bytecode containing the miscompiled pattern.
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professional Core Libraries can trigger abnormal middleware behavior and degrade or halt that application's availability; the root cause is an incorrect calculation (CWE-682) that can be exploited by sending crafted DDS/RTPS traffic with no authentication, user interaction, or non-default configuration. All shipping branches are covered by the advisory: 7.4.0 through 7.7.0.0, 7.0.0 through 7.3.1.5, the 6.1.x, 6.0.x, 5.3.x and 5.2.x lines, and 4.1x through 5.0.x, with fixes available at 7.7.0.1, 7.3.1.6, and the 5.1.x legacy line. The impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS 4.0 score of 8.7 reflects the same unauthenticated, network-reachable, high-availability-impact profile.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Optimizer miscompilation in Vyper 0.3.8 through 0.5.0b1 can silently replace a ternary branch expression of the form (msg.value | K) or (len(msg.data) | K) with the constant 1 under default -O gas or -O codesize, corrupting contract logic and potentially locking funds. Only contracts containing that exact OR-in-ternary construct and compiled with an affected version are exposed; the flaw is a compiler-correctness issue rather than a runtime memory-safety bug. No public exploit code was identified at time of analysis, and risk is highly conditional on deployed bytecode containing the miscompiled pattern.
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professional Core Libraries can trigger abnormal middleware behavior and degrade or halt that application's availability; the root cause is an incorrect calculation (CWE-682) that can be exploited by sending crafted DDS/RTPS traffic with no authentication, user interaction, or non-default configuration. All shipping branches are covered by the advisory: 7.4.0 through 7.7.0.0, 7.0.0 through 7.3.1.5, the 6.1.x, 6.0.x, 5.3.x and 5.2.x lines, and 4.1x through 5.0.x, with fixes available at 7.7.0.1, 7.3.1.6, and the 5.1.x legacy line. The impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS 4.0 score of 8.7 reflects the same unauthenticated, network-reachable, high-availability-impact profile.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.