Denial Of Service
Monthly
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special tooling, and is easily automatable against any internet-exposed deployment.
NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.
Remote denial-of-service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by sending a crafted UDP packet to the RPC service. The attack requires no credentials or user interaction and results in complete system unavailability, demanding an LPAR restart to recover - a non-trivial operational impact for enterprise environments running critical POWER-based workloads. No public exploit code has been identified at time of analysis, but the trivially low attack complexity against a zero-authentication network service elevates practical risk.
Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is reachable by unauthenticated remote attackers through improper validation of an allocation size, crashing the affected system or service without any user interaction. The vulnerability carries a CVSS 7.5 High score driven entirely by a complete availability impact against a network-accessible, zero-prerequisite attack path. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker via a NULL pointer dereference (CWE-476) in a network-accessible component, yielding full availability loss against affected systems. The vulnerability carries a CVSS 7.5 High score with no confidentiality or integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker to crash affected systems by supplying a crafted request that exploits improper validation of an array size field. The CVSS 7.5 (High) score reflects a fully network-exploitable, zero-complexity, no-privilege-required attack path targeting availability exclusively. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this has not yet been weaponized at scale.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.
Denial-of-service in Bandit (Elixir HTTP server) versions 0.3.4 through 1.12.4 allows unauthenticated remote attackers to pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting the absence of any timeout on the connection-level HTTP/2 send window queue. When a response body exceeds the default 65,535-byte connection window, the stream process blocks forever inside a synchronous GenServer call, and neither RST_STREAM frames nor periodic PING keepalives free the stalled resources in vulnerable versions - the attacker can keep the connection alive with PINGs specifically to defeat the transport read timeout. No public exploit code has been identified at time of analysis, but the attack primitive requires no authentication and is repeatable across streams and connections at the cost of one idle socket each.
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. No public exploit has been identified at time of analysis and EPSS is very low (0.14%, 4th percentile), but the attack is conceptually simple and requires no authentication.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.
Use-after-free in Tor's conflux (multipath) circuit implementation lets a malicious exit node crash affected Tor clients. When a conflux recovery leg revives a conflux set whose last linked leg has already been closed, the object's reference count is mishandled, producing a use-after-free and potential double free (TROVE-2026-026). Exploitation requires the victim to run Tor 0.4.8.1-alpha through 0.4.9.11, to have conflux/multipath circuits active, and to route a circuit through the attacker's exit node, so attacker success is probabilistic; impact is limited to denial of service with no code execution or data exposure confirmed. No public exploit code was identified at time of analysis, EPSS is 0.22% (13th percentile), and the issue is not listed in CISA KEV.
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. Impact ranges from denial of service through malformed object behavior to potential downstream logic bypasses, depending on how polluted properties interact with application code. No public exploit is identified at time of analysis and no CISA KEV listing exists; vendor-released patch is confirmed at version 1.3.3.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Unbounded memory consumption in Netty's Binary HTTP (BHTTP) codec allows any remote peer to trigger out-of-memory (OOM) conditions by sending crafted encoded variable-length field values. The BinaryHttpParser in netty-incubator-codec-bhttp versions up to and including 0.0.22.Final applies no upper-bound enforcement on variable-length integers used for field sizes, meaning a malicious or misbehaving peer can instruct the parser to buffer arbitrarily large amounts of data until the JVM heap is exhausted. No public exploit has been identified at time of analysis, and no KEV listing exists, but the straightforward nature of the trigger makes exploitation trivial for any party with network access to a service using this codec.
Infinite parse loop in netty-incubator-codec-bhttp's BinaryHttpParser allows any remote peer capable of sending Binary HTTP input to permanently pin a Netty event-loop thread, causing denial of service. The flaw exists in versions up to and including 0.0.22.Final and is triggered by a structurally valid known-length field section whose last field line ends exactly at the declared section boundary - no malformed framing is required. A public proof-of-concept is included in the GHSA advisory, and the condition is also reachable through the OHTTP inner parser after successful decryption, meaning authenticated OHTTP peers are a second exploitation path.
Heap exhaustion denial-of-service in the node-opcua npm library (versions ≤ 2.165.0) allows an unauthenticated remote attacker to crash the server process by repeatedly initiating OPC-UA sessions with unique nonces. The root cause is a process-global nonce cache (`g_alreadyUsedNonce`) that accumulates entries indefinitely with no TTL or eviction, causing unbounded heap growth measurable at approximately 1.23 MB per 5,000 nonces - achievable OOM under default Node.js heap limits. No public exploit code is identified beyond researcher-disclosed proof-of-concept details in GHSA-6wvw-vrw4-363w; exploitation requires only network access and a trivial script.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processes by sending an unbounded stream of fragmented WebSocket frames. Affected versions span 2.2.0-alpha-dev through pre-fix 2.2.2-alpha; the evws WebSocket API enforces WS_MAX_RECV_FRAME_SZ per individual frame but applies no cap to the total accumulated message size in evws->incomplete_frames, enabling heap growth without limit. No public exploit has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog; however, exploitation is trivially simple for any WebSocket client.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network attack vector and libexpat's broad transitive footprint across runtimes and distributions make this a meaningful availability risk.
Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Remote authenticated exploitation of IBM i versions 7.3 through 7.6 via an out-of-bounds read (CWE-125) enables attackers to both crash the system and exfiltrate sensitive data from adjacent memory regions. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects significant dual confidentiality and availability impact achievable over the network without user interaction, though a minimum of low-privilege credentials is required, limiting the attack surface to authenticated accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at a low 0.31% (24th percentile), and SSVC rates the attack as non-automatable.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Remote unauthenticated memory corruption in RDK-B WebUI (build rdkb-2025q4-kirkstone.04.10.26) arises from a heap-based buffer overflow in the multipart/form-data parser in jst_post.c, letting an attacker send a single crafted POST request to corrupt heap memory. Confirmed impact is denial of service via crashing the WebUI service, with potential remote code execution on the broadband gateway if the overflow is weaponized. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low (0.29%, 21st percentile) despite the 9.8 CVSS.
Denial of service in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 is achievable by any remote unauthenticated attacker who submits an excessively large password value to the login handler, triggering uncontrolled resource consumption in the `check.jst` template. The flaw (CWE-400) requires no credentials, no user interaction, and no special configuration - any device with its WebUI reachable is vulnerable to availability loss. EPSS sits at 0.22% (13th percentile), and no active exploitation or public exploit code has been identified at time of analysis, keeping real-world urgency moderate despite the high CVSS base score.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Concurrent sponsored-payment flooding in ZenHive mpp (versions 0.2.0 through 0.12.0) allows an unauthenticated remote client to drain a fee-payer wallet to zero, denying service to all legitimate sponsored-transaction users once the wallet is empty. The root cause is that MPP.Methods.Tempo.FeePayerPolicy enforces per-transaction budget ceilings but maintains no aggregate accounting across concurrent in-flight sponsorships, meaning N simultaneous sponsored requests commit N × max_total_fee against the wallet with no global cap. No public exploit has been identified at time of analysis, but the attack is mechanically trivial once the sponsor endpoint is reachable - no authentication, no cryptographic preconditions, only the ability to issue distinct signed transactions with distinct nonces within the 900-second validity window.
Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Authentication bypass via WebAuthn assertion replay in phpMyFAQ affects all versions up to and including 4.1.5, fixed in 4.1.7. Because prepareForLogin generates a login challenge but neither WebAuthn controller writes the mutated key object back to the database, the anti-replay check is short-circuited by its own null guard, so an attacker who captures one successful WebAuthn assertion can resubmit it indefinitely to log in as that user with no hardware key or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well documented in the vendor advisory.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special tooling, and is easily automatable against any internet-exposed deployment.
NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
DLL hijacking in Remote Utilities Host ≤7.7.3.0 allows any local, unprivileged Windows user to achieve NT AUTHORITY\SYSTEM-level code execution by replacing service DLLs during a race window. The installer incorrectly grants BUILTIN\Everyone FULL CONTROL over all DLL files in the installation directory - including libasset32.dll and seven additional codec and multimedia libraries - enabling overwrite by any local account. No public exploit is identified at time of analysis, but the technique is well-established and the race window reliably materializes during software updates, service crashes, or manual restarts.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.
Remote denial-of-service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by sending a crafted UDP packet to the RPC service. The attack requires no credentials or user interaction and results in complete system unavailability, demanding an LPAR restart to recover - a non-trivial operational impact for enterprise environments running critical POWER-based workloads. No public exploit code has been identified at time of analysis, but the trivially low attack complexity against a zero-authentication network service elevates practical risk.
Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is reachable by unauthenticated remote attackers through improper validation of an allocation size, crashing the affected system or service without any user interaction. The vulnerability carries a CVSS 7.5 High score driven entirely by a complete availability impact against a network-accessible, zero-prerequisite attack path. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker via a NULL pointer dereference (CWE-476) in a network-accessible component, yielding full availability loss against affected systems. The vulnerability carries a CVSS 7.5 High score with no confidentiality or integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker to crash affected systems by supplying a crafted request that exploits improper validation of an array size field. The CVSS 7.5 (High) score reflects a fully network-exploitable, zero-complexity, no-privilege-required attack path targeting availability exclusively. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this has not yet been weaponized at scale.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.
Denial-of-service in Bandit (Elixir HTTP server) versions 0.3.4 through 1.12.4 allows unauthenticated remote attackers to pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting the absence of any timeout on the connection-level HTTP/2 send window queue. When a response body exceeds the default 65,535-byte connection window, the stream process blocks forever inside a synchronous GenServer call, and neither RST_STREAM frames nor periodic PING keepalives free the stalled resources in vulnerable versions - the attacker can keep the connection alive with PINGs specifically to defeat the transport read timeout. No public exploit code has been identified at time of analysis, but the attack primitive requires no authentication and is repeatable across streams and connections at the cost of one idle socket each.
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. No public exploit has been identified at time of analysis and EPSS is very low (0.14%, 4th percentile), but the attack is conceptually simple and requires no authentication.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.
Use-after-free in Tor's conflux (multipath) circuit implementation lets a malicious exit node crash affected Tor clients. When a conflux recovery leg revives a conflux set whose last linked leg has already been closed, the object's reference count is mishandled, producing a use-after-free and potential double free (TROVE-2026-026). Exploitation requires the victim to run Tor 0.4.8.1-alpha through 0.4.9.11, to have conflux/multipath circuits active, and to route a circuit through the attacker's exit node, so attacker success is probabilistic; impact is limited to denial of service with no code execution or data exposure confirmed. No public exploit code was identified at time of analysis, EPSS is 0.22% (13th percentile), and the issue is not listed in CISA KEV.
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. Impact ranges from denial of service through malformed object behavior to potential downstream logic bypasses, depending on how polluted properties interact with application code. No public exploit is identified at time of analysis and no CISA KEV listing exists; vendor-released patch is confirmed at version 1.3.3.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Unbounded memory consumption in Netty's Binary HTTP (BHTTP) codec allows any remote peer to trigger out-of-memory (OOM) conditions by sending crafted encoded variable-length field values. The BinaryHttpParser in netty-incubator-codec-bhttp versions up to and including 0.0.22.Final applies no upper-bound enforcement on variable-length integers used for field sizes, meaning a malicious or misbehaving peer can instruct the parser to buffer arbitrarily large amounts of data until the JVM heap is exhausted. No public exploit has been identified at time of analysis, and no KEV listing exists, but the straightforward nature of the trigger makes exploitation trivial for any party with network access to a service using this codec.
Infinite parse loop in netty-incubator-codec-bhttp's BinaryHttpParser allows any remote peer capable of sending Binary HTTP input to permanently pin a Netty event-loop thread, causing denial of service. The flaw exists in versions up to and including 0.0.22.Final and is triggered by a structurally valid known-length field section whose last field line ends exactly at the declared section boundary - no malformed framing is required. A public proof-of-concept is included in the GHSA advisory, and the condition is also reachable through the OHTTP inner parser after successful decryption, meaning authenticated OHTTP peers are a second exploitation path.
Heap exhaustion denial-of-service in the node-opcua npm library (versions ≤ 2.165.0) allows an unauthenticated remote attacker to crash the server process by repeatedly initiating OPC-UA sessions with unique nonces. The root cause is a process-global nonce cache (`g_alreadyUsedNonce`) that accumulates entries indefinitely with no TTL or eviction, causing unbounded heap growth measurable at approximately 1.23 MB per 5,000 nonces - achievable OOM under default Node.js heap limits. No public exploit code is identified beyond researcher-disclosed proof-of-concept details in GHSA-6wvw-vrw4-363w; exploitation requires only network access and a trivial script.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processes by sending an unbounded stream of fragmented WebSocket frames. Affected versions span 2.2.0-alpha-dev through pre-fix 2.2.2-alpha; the evws WebSocket API enforces WS_MAX_RECV_FRAME_SZ per individual frame but applies no cap to the total accumulated message size in evws->incomplete_frames, enabling heap growth without limit. No public exploit has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog; however, exploitation is trivially simple for any WebSocket client.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network attack vector and libexpat's broad transitive footprint across runtimes and distributions make this a meaningful availability risk.
Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Remote authenticated exploitation of IBM i versions 7.3 through 7.6 via an out-of-bounds read (CWE-125) enables attackers to both crash the system and exfiltrate sensitive data from adjacent memory regions. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects significant dual confidentiality and availability impact achievable over the network without user interaction, though a minimum of low-privilege credentials is required, limiting the attack surface to authenticated accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at a low 0.31% (24th percentile), and SSVC rates the attack as non-automatable.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Remote unauthenticated memory corruption in RDK-B WebUI (build rdkb-2025q4-kirkstone.04.10.26) arises from a heap-based buffer overflow in the multipart/form-data parser in jst_post.c, letting an attacker send a single crafted POST request to corrupt heap memory. Confirmed impact is denial of service via crashing the WebUI service, with potential remote code execution on the broadband gateway if the overflow is weaponized. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low (0.29%, 21st percentile) despite the 9.8 CVSS.
Denial of service in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 is achievable by any remote unauthenticated attacker who submits an excessively large password value to the login handler, triggering uncontrolled resource consumption in the `check.jst` template. The flaw (CWE-400) requires no credentials, no user interaction, and no special configuration - any device with its WebUI reachable is vulnerable to availability loss. EPSS sits at 0.22% (13th percentile), and no active exploitation or public exploit code has been identified at time of analysis, keeping real-world urgency moderate despite the high CVSS base score.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Concurrent sponsored-payment flooding in ZenHive mpp (versions 0.2.0 through 0.12.0) allows an unauthenticated remote client to drain a fee-payer wallet to zero, denying service to all legitimate sponsored-transaction users once the wallet is empty. The root cause is that MPP.Methods.Tempo.FeePayerPolicy enforces per-transaction budget ceilings but maintains no aggregate accounting across concurrent in-flight sponsorships, meaning N simultaneous sponsored requests commit N × max_total_fee against the wallet with no global cap. No public exploit has been identified at time of analysis, but the attack is mechanically trivial once the sponsor endpoint is reachable - no authentication, no cryptographic preconditions, only the ability to issue distinct signed transactions with distinct nonces within the 900-second validity window.
Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Authentication bypass via WebAuthn assertion replay in phpMyFAQ affects all versions up to and including 4.1.5, fixed in 4.1.7. Because prepareForLogin generates a login challenge but neither WebAuthn controller writes the mutated key object back to the database, the anti-replay check is short-circuited by its own null guard, so an attacker who captures one successful WebAuthn assertion can resubmit it indefinitely to log in as that user with no hardware key or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well documented in the vendor advisory.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.