Monthly
Denial of service in SGLang 0.5.20 and earlier: the /generate HTTP endpoint in prefill/decode (PD) disaggregation deployments using the Mooncake KV transfer backend does not validate duplicate bootstrap_room identifiers, so remote unauthenticated attackers who fire concurrent requests carrying the same bootstrap_room value can crash scheduler processes or stall other users' requests until the transfer times out. The attack is trivial and requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, availability-only VA:H), but it only affects the non-default multi-node PD disaggregation configuration with the Mooncake backend; single-node and default deployments are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is purely availability-related with no confidentiality or integrity loss.
Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.
Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
GeoJSON documents written through the MongoDB C# Driver can be persisted with duplicate geometry members, so the server and the driver resolve different values for the same record and affected documents may become unreadable through the driver, interrupting application read paths. Exposure is limited to applications running driver versions 1.8.0 up to but not including 3.13.0 that copy user-supplied field names into GeoJSON extra members and allow those names to collide with reserved members such as type and coordinates; standard GeoJSON usage without attacker-controlled extra-member names is unaffected. The CVSS 4.0 base score is 5.3 (authenticated, network-reachable, confidentiality none, integrity low, availability low), no public exploit was identified at time of analysis, and the vendor has released 3.13.0 as the fix.
Python's filelock library, versions 4.1.0 through 4.2.0, allows a local attacker who is already contending on the same lock path to trick the SoftFileLock, MarkerSoftFileLock, and SoftFileLease implementations into deleting a legitimate holder's live marker file, silently breaking the mutual exclusion the lock is supposed to guarantee and letting concurrent processes enter a protected critical section together. Exploitation is not trivial: it requires a pre-dated attacker marker that is removed on cue, at least two waiting contenders, coarse or matching modification times that preserve the stale observation, and inode reuse on the filesystem (ext4 is the named enabler) so that an honest contender's fresh marker lands on the recycled inode. The impact is integrity-only with no confidentiality or availability component, the vector is strictly local and high-complexity (CVSS 4.7), no public exploit code was identified at time of analysis, and the flaw is fixed in 4.2.1.
Duplicate customer-identity records can be created in OTRS whenever more than one CustomerUser backend is configured (for example a database backend alongside LDAP), because the email-address uniqueness check is applied only within the backend selected at the time of creation rather than across all backends. An authenticated operator holding the permission to create or modify customer users (PR:L per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 5.4) can therefore register an address already assigned to a customer in another backend, after which ticket records or outgoing email may be associated with, or exposed to, the wrong customer identity. Exploitability is narrowed by two prerequisites - a non-default multi-backend CustomerUser configuration and a privileged customer-user management role - so this is a genuine but moderate-priority integrity and information-exposure issue rather than an urgent emergency; no public exploit identified at time of analysis and no CISA KEV listing.
JupyterHub deployments through 6.0.1 that run in multi-user mode with the named-server feature enabled allow an authenticated low-privilege user to hijack the OAuth client identity of another user's named server by registering a hyphenated username that collides with the victim's client identifier (for example, an attacker named 'alice-prod' overwrites the client used by user 'alice' for server 'prod'). The overwrite breaks the victim's OAuth login flow and revokes their tokens when the attacker stops their own server, producing a targeted, account-level denial of service rather than a broad compromise; it requires the attacker to hold an authenticated account whose name they can control and to know the victim/target server combination in advance. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-assigned CVSS 4.0 base score is 2.3, consistent with an independent assessment of LOW severity.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Account lockout abuse in Ercom Cryptobox allows any authenticated user to deny another user access by sending a specially crafted request that triggers the platform's lockout mechanism. Specific versions in the 4.37-4.40 range are confirmed affected per ENISA EUVD-2026-26070, and the vendor has released a patch. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile) and CISA SSVC marks exploitation status as none, placing this firmly in the category of a real but low-urgency availability risk.
A critical authentication bypass vulnerability in Keylime allows attackers with high privileges to register malicious agents using different TPM devices while claiming existing agent UUIDs, effectively overwriting legitimate agent identities. This enables impersonation of trusted agents and potential bypass of security controls in the remote attestation system. With an EPSS score of 0.07% (21st percentile) and no known KEV listing, the vulnerability has a high CVSS score of 8.2 but relatively low real-world exploitation likelihood.
Denial of service in SGLang 0.5.20 and earlier: the /generate HTTP endpoint in prefill/decode (PD) disaggregation deployments using the Mooncake KV transfer backend does not validate duplicate bootstrap_room identifiers, so remote unauthenticated attackers who fire concurrent requests carrying the same bootstrap_room value can crash scheduler processes or stall other users' requests until the transfer times out. The attack is trivial and requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, availability-only VA:H), but it only affects the non-default multi-node PD disaggregation configuration with the Mooncake backend; single-node and default deployments are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is purely availability-related with no confidentiality or integrity loss.
Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.
Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
GeoJSON documents written through the MongoDB C# Driver can be persisted with duplicate geometry members, so the server and the driver resolve different values for the same record and affected documents may become unreadable through the driver, interrupting application read paths. Exposure is limited to applications running driver versions 1.8.0 up to but not including 3.13.0 that copy user-supplied field names into GeoJSON extra members and allow those names to collide with reserved members such as type and coordinates; standard GeoJSON usage without attacker-controlled extra-member names is unaffected. The CVSS 4.0 base score is 5.3 (authenticated, network-reachable, confidentiality none, integrity low, availability low), no public exploit was identified at time of analysis, and the vendor has released 3.13.0 as the fix.
Python's filelock library, versions 4.1.0 through 4.2.0, allows a local attacker who is already contending on the same lock path to trick the SoftFileLock, MarkerSoftFileLock, and SoftFileLease implementations into deleting a legitimate holder's live marker file, silently breaking the mutual exclusion the lock is supposed to guarantee and letting concurrent processes enter a protected critical section together. Exploitation is not trivial: it requires a pre-dated attacker marker that is removed on cue, at least two waiting contenders, coarse or matching modification times that preserve the stale observation, and inode reuse on the filesystem (ext4 is the named enabler) so that an honest contender's fresh marker lands on the recycled inode. The impact is integrity-only with no confidentiality or availability component, the vector is strictly local and high-complexity (CVSS 4.7), no public exploit code was identified at time of analysis, and the flaw is fixed in 4.2.1.
Duplicate customer-identity records can be created in OTRS whenever more than one CustomerUser backend is configured (for example a database backend alongside LDAP), because the email-address uniqueness check is applied only within the backend selected at the time of creation rather than across all backends. An authenticated operator holding the permission to create or modify customer users (PR:L per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 5.4) can therefore register an address already assigned to a customer in another backend, after which ticket records or outgoing email may be associated with, or exposed to, the wrong customer identity. Exploitability is narrowed by two prerequisites - a non-default multi-backend CustomerUser configuration and a privileged customer-user management role - so this is a genuine but moderate-priority integrity and information-exposure issue rather than an urgent emergency; no public exploit identified at time of analysis and no CISA KEV listing.
JupyterHub deployments through 6.0.1 that run in multi-user mode with the named-server feature enabled allow an authenticated low-privilege user to hijack the OAuth client identity of another user's named server by registering a hyphenated username that collides with the victim's client identifier (for example, an attacker named 'alice-prod' overwrites the client used by user 'alice' for server 'prod'). The overwrite breaks the victim's OAuth login flow and revokes their tokens when the attacker stops their own server, producing a targeted, account-level denial of service rather than a broad compromise; it requires the attacker to hold an authenticated account whose name they can control and to know the victim/target server combination in advance. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-assigned CVSS 4.0 base score is 2.3, consistent with an independent assessment of LOW severity.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Account lockout abuse in Ercom Cryptobox allows any authenticated user to deny another user access by sending a specially crafted request that triggers the platform's lockout mechanism. Specific versions in the 4.37-4.40 range are confirmed affected per ENISA EUVD-2026-26070, and the vendor has released a patch. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile) and CISA SSVC marks exploitation status as none, placing this firmly in the category of a real but low-urgency availability risk.
A critical authentication bypass vulnerability in Keylime allows attackers with high privileges to register malicious agents using different TPM devices while claiming existing agent UUIDs, effectively overwriting legitimate agent identities. This enables impersonation of trusted agents and potential bypass of security controls in the remote attestation system. With an EPSS score of 0.07% (21st percentile) and no known KEV listing, the vulnerability has a high CVSS score of 8.2 but relatively low real-world exploitation likelihood.