Denial Of Service
Monthly
Heap buffer overflow in BusyBox udhcpc6 (DHCPv6 client) allows network-adjacent attackers to achieve remote code execution or denial of service on embedded systems. The vulnerability stems from incorrect heap buffer allocation in option_to_env() when parsing D6_OPT_DNS_SERVERS options in DHCPv6 responses. Particularly dangerous on embedded devices lacking heap hardening protections. Fixed in commit 42202bf. No active exploitation confirmed (not in CISA KEV), but publicly available proof-of-concept from VulnCheck disclosure increases real-world risk for IoT and embedded deployments.
Memory exhaustion in Prometheus remote read endpoint allows unauthenticated attackers to crash the monitoring server via maliciously crafted snappy-compressed payloads. The /api/v1/read endpoint in versions prior to 3.5.3 and 3.11.3 accepts compressed request bodies without validating the declared decoded length, enabling a 5-byte payload claiming 256 MiB decoded size to trigger massive heap allocations. Concurrent requests can exhaust memory and crash the Prometheus process. EPSS data not provided; no evidence of active exploitation (not in CISA KEV). Vendor-released patches available in versions 3.5.3 and 3.11.3.
Remote denial of service in the Postfix mail transfer agent (before 3.8.16, 3.9.x before 3.9.10, and 3.10.x before 3.10.9) lets attackers crash the process through a malformed enhanced status code that ends immediately after the third numeric component with no trailing text, triggering a buffer over-read. The flaw affects availability only - no data exposure or code execution - and has no public exploit identified at time of analysis. EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none and non-automatable, consistent with a crash-only bug.
Nil-pointer dereference in Incus daemon's custom volume backup import logic allows authenticated users to crash the service by supplying a malformed backup archive containing null entries in the volume_snapshots array, enabling repeated denial of service attacks. The vulnerability exists in the CreateCustomVolumeFromBackup function which fails to validate snapshot pointers before dereferencing them during import operations. CVSS 6.5 (authenticated network access, high availability impact); no public exploit code or active exploitation reported at analysis time, but proof-of-concept demonstration included in advisory.
Nil-pointer dereference in Incus daemon's storage bucket import logic allows authenticated users to crash the daemon by submitting a malformed bucket backup archive with a missing config section in index.yaml, enabling denial of service through repeated exploitation. The vulnerability affects Incus versions prior to 7.0.0 and requires valid storage bucket feature access but no special privileges beyond authenticated user status.
Remote denial of service in Apache OpenNLP versions before 2.5.9 and 3.0.0-M3 allows unauthenticated attackers to crash JVM processes by uploading malicious .bin model files that trigger OutOfMemoryError through unbounded array allocation. Exploitation requires no authentication (AV:N/AC:L/PR:N) and affects any code path deserializing binary model files from untrusted sources. EPSS score of 0.02% (5th percentile) suggests low widespread exploitation risk, and no active exploitation or public POC has been identified at time of analysis. Vendor-released patches are available with default safeguards limiting count fields to 10 million entries.
Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL pointer dereference in mod_dav_lock, causing denial of service. The vulnerability affects only servers with mod_dav_lock enabled, a legacy module whose primary use-case (Apache Subversion < 1.2.0) is obsolete in modern deployments. CISA SSVC indicates no active exploitation, but the attack is automatable against susceptible configurations. CVSS 7.5 (High) reflects network-accessible, unauthenticated denial of service, though real-world impact is limited to the small subset of servers still running mod_dav_lock.
Denial of Service in FRRouting 10.0 through 10.6 allows remote unauthenticated attackers to crash the BGP daemon via a malformed BGP UPDATE message exploiting an integer underflow in next-hop capability processing. Upstream fix available in commit 693a2e0 but released patched version not independently confirmed. No public exploit identified at time of analysis, with EPSS score not provided suggesting low observed exploitation activity.
Remote attackers can crash GoBGP v4.3.0 by sending a malformed BGP UPDATE message that triggers an out-of-bounds read in IPv6 extended community parsing. The flaw allows unauthenticated denial of service against default configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability. Upstream fixes available via GitHub commits 362cce3e and 9ce8936.
Memory exhaustion in Bandit WebSocket server (versions 0.5.9 through 1.10.x) allows unauthenticated remote attackers to crash BEAM nodes via compression bombs when permessage-deflate is enabled. The inflate/2 function decompresses WebSocket frames without output-size limits, enabling attackers to send tiny compressed payloads (~1024:1 ratio) that expand to gigabyte-scale heap allocations. Vendor-released patch available (version 1.11.0). EPSS data not available; no public exploit identified at time of analysis. Exploitation requires non-default configuration (both server-level compress and per-upgrade compress: true options enabled), making stock Phoenix/LiveView applications unaffected.
Memory exhaustion in Bandit WebSocket server (versions 0.5.0 through 1.10.x) allows unauthenticated remote attackers to trigger denial of service by sending unbounded WebSocket continuation frames without setting the fin flag. The fragment reassembly logic accumulates payloads without checking cumulative message size, bypassing the max_frame_size limit which only applies to individual frames. Applications using Phoenix Channels or LiveView over Bandit expose this attack surface on any WebSocket endpoint. Patch available in version 1.11.0 introduces max_fragmented_message_size parameter (default 8MB). No public exploit code identified at time of analysis, but trivial to reproduce with standard WebSocket libraries.
Remote unauthenticated denial of service crashes Vanetza V2X v26.02 receivers via malformed GeoNetworking packets containing invalid ECC points. Uncaught OpenSSL exceptions from elliptic curve point validation (invalid compressed points, points not on curve) in the security layer escape through the Router::indicate() call chain, triggering std::terminate and process termination. No public exploit identified at time of analysis, though EPSS risk assessment unavailable. Attack requires only network access to the V2X receiver endpoint with no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making this a significant operational risk for deployed V2X infrastructure relying on continuous availability for vehicle safety communications.
Use-after-free in Imagination Graphics DDK GPU GLES user-space library allows authenticated remote attackers to crash the GPU render process via crafted WebGPU content. CVSS 8.1 (High) with network vector and low complexity. On platforms where the GPU process runs with elevated system privileges, successful exploitation could enable system-level compromise beyond the initial crash. EPSS and KEV data not provided; SSVC framework indicates no confirmed exploitation, non-automatable attack, but total technical impact. Vendor patches available across affected DDK versions 1.18, 23.2, 24.1-24.2, and 25.1-25.3.
Remote authenticated attackers can execute code or cause persistent denial-of-service in Imagination Technologies Graphics DDK by triggering a use-after-free in the GPU GLES render process via specially crafted WebGPU content. On platforms where the GPU driver runs with elevated system privileges, successful exploitation enables device-level compromise beyond the browser sandbox. EPSS data not available, no CISA KEV listing identified, no public POC confirmed. SSVC framework indicates no active exploitation and non-automatable attack requiring authenticated interaction.
Heap-based buffer overflow in hashcat 7.1.2 enables remote code execution or denial of service through maliciously crafted PKZIP hash files. Attackers can exploit inadequate input validation in the hex_to_binary function affecting PKZIP hash parser modules (17200, 17210, 17220, 17225, 17230) to overflow fixed-size buffers with arbitrary hex data. CVSS 9.8 reflects network-accessible attack vector requiring no authentication or user interaction, though real-world exploitation requires victim to process attacker-supplied hash files. EPSS data not available; no CISA KEV listing indicates no confirmed widespread exploitation. Public proof-of-concept exists (GitHub Gist), elevating exploitation risk for environments processing untrusted hash files.
Heap-based buffer overflow in hashcat 7.1.2's Kerberos hash parser enables remote code execution without authentication. Attacker supplies a maliciously crafted Kerberos hash file with manipulated delimiter positions to overflow the fixed-size account_info buffer during memcpy operations in module_hash_decode. The vulnerability affects multiple Kerberos-related hashcat modules due to missing upper-bound validation on account_info_len before memory copy. CVSS 9.8 with network attack vector, but real-world exploitation requires user processing the malicious file. EPSS data not available; no active exploitation confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in hashcat 7.1.2's rule processing functions enables remote code execution when processing password candidates of 128+ characters. The vulnerability stems from inadequate bounds checking in mangle_to_hex_lower() and mangle_to_hex_upper() functions that fail to account for 2x memory expansion during byte-to-hex conversion. CVSS 9.8 (critical) with network attack vector and no authentication required. Public proof-of-concept code available via GitHub gist. No CISA KEV listing suggests targeted rather than widespread exploitation despite theoretical network exploitability.
Use-after-free condition in Linux kernel writeback subsystem allows local authenticated attackers to potentially execute arbitrary code, escalate privileges, or trigger kernel crashes. The vulnerability affects Linux kernel versions 6.18.x through 7.1-rc1 and arises from improper synchronization between work queue processing and memory deallocation in inode_switch_wbs_work_fn(). Vendor patches are available across stable kernel branches (6.18.25, 7.0.2, 7.1-rc1) with low EPSS score (0.02%) indicating minimal observed exploitation activity, though the CVSS 7.8 score reflects significant impact if successfully exploited by authenticated local users.
Use-after-free in Linux kernel macb driver allows local authenticated attackers to cause denial of service or potentially escalate privileges during module removal. The vulnerability occurs in the PCI glue driver when platform_device_unregister() triggers a runtime resume callback that attempts to access already-freed clock structures. EPSS score is low (0.02%) with no evidence of active exploitation. Vendor patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
Integer overflow in Linux kernel io_uring subsystem allows local authenticated users to trigger slab-out-of-bounds memory reads and denial of service. The vulnerability stems from improper type casting of user-supplied length values in network bundled receive/send operations, where values exceeding INT_MAX cause negative overflow leading to infinite loops and out-of-bounds array access. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Vendor patches available for affected stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0), making this a straightforward patching priority for systems running vulnerable versions with io_uring enabled.
Missing CRYPTO_ALG_ASYNC flag in Linux kernel's Tegra crypto driver causes the crypto API to incorrectly select asynchronous algorithms for synchronous-only requests, resulting in system crashes. This affects Tegra-based Linux systems (typically NVIDIA Jetson devices) running kernel versions 6.10 through early 7.0 development branches. Vendor patches are available across stable branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability, and no active exploitation or public POC has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:N) suggests network-based exploitation requiring authenticated access, though this conflicts with the technical nature of a local driver configuration bug.
Algorithmic complexity denial of service in Apache Neethi allows remote unauthenticated attackers to exhaust JVM heap memory via malicious WS-Policy documents. Specially crafted policy documents trigger exponential Cartesian cross-product expansion during normalization, generating unbounded policy alternatives that consume all available memory. Apache has released version 3.2.2 with normalization limits to prevent exploitation. EPSS data not available; no CISA KEV listing identified at time of analysis.
Denial of Service in Apache Neethi WS-Policy processor allows remote unauthenticated attackers to crash applications or cause resource exhaustion by sending crafted policy documents with circular references. The vulnerability (CVSS 7.5) triggers infinite loops or stack overflow during policy normalization when Policy A references Policy B which references Policy A. Apache released version 3.2.2 to address this flaw. With network vector, low complexity, and no authentication required (AV:N/AC:L/PR:N), this represents a readily exploitable attack surface for applications parsing untrusted WS-Policy documents, though no public exploit or active exploitation (KEV) has been identified at time of analysis.
Remote denial of service in FRRouting stable/10.0 allows unauthenticated attackers to crash the BGP daemon via malformed FlowSpec NLRI messages. The off-by-one vulnerability in bgp_flowspec_op_decode() enables out-of-bounds writes when parsing crafted BGP FlowSpec components, causing process termination. EPSS exploitation probability data not available, but SSVC marks this as automatable with partial technical impact. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting theoretical rather than actively exploited risk.
Remote code execution in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 allows unauthenticated network attackers to execute arbitrary code or crash the system by sending malformed CANswitch frames with invalid DLC (Data Length Code) values. The buffer overflow occurs in the canformat_canswitch.cpp parser module which fails to validate frame length parameters before processing, enabling memory corruption. A proof-of-concept exploit is publicly available on GitHub, and SSVC assessment indicates the vulnerability is automatable with partial technical impact, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Remote code execution in cannelloni v2.0.0 allows unauthenticated network attackers to crash the service or execute arbitrary code by sending malformed CAN FD frames that trigger buffer overflows in two separate parsing functions (parseCANFrame in parser.cpp and decodeFrame in decoder.cpp). The CVSS score of 9.8 reflects network-accessible exploitation requiring no authentication or user interaction, with complete system compromise possible. Public proof-of-concept code exists (GitHub Gist reference), elevating immediate exploitation risk despite no CISA KEV listing, suggesting targeted rather than mass exploitation scenarios.
Remote unauthenticated attackers can crash socketcand 0.4.2 daemon by sending a malformed CAN bus name that triggers a stack-based buffer overflow in the main function's socketcand.c implementation. The CVSS vector indicates network-accessible denial of service with no authentication required. A publicly available proof-of-concept exists (GitHub Gist reference), but CISA KEV status is not confirmed, and EPSS data is unavailable. The low attack complexity (AC:L) and network attack vector (AV:N) make this readily exploitable against exposed instances, though the impact is currently limited to availability (A:H) with no confirmed confidentiality or integrity impacts.
Remote code execution in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 allows network-based attackers to execute arbitrary code or crash the system without authentication. A buffer overflow in the GVRET CAN data parser (canformat_gvret.cpp) fails to validate length fields in binary frames, enabling memory corruption. CVSS 10.0 reflects unauthenticated network vector with scope change, but no public exploit or active exploitation confirmed at time of analysis. EPSS data unavailable; real-world risk depends on OVMS3 deployment exposure (typically vehicle telematics environments).
Buffer overflow in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 enables remote code execution when processing malicious PCAP files. The canformat_pcap.cpp parser fails to validate the phdr.len field, allowing attackers to overflow stack buffers and execute arbitrary code with high confidentiality, integrity, and availability impact. Public proof-of-concept code exists (GitHub Gist), though no active exploitation is confirmed by CISA KEV. SSVC assessment indicates automatable exploitation despite requiring user interaction to open crafted PCAP files.
Remote denial of service in Open-SAE-J1939 library (commit b6caf884 and prior, November 2025) allows unauthenticated attackers to crash SAE J1939 protocol implementations by sending malformed CAN frames to the J1939 bus. Exploitation is straightforward (CVSS AC:L, SSVC automatable:yes) and requires only network access to the CAN bus. No public exploit code confirmed, but GIST reference suggests proof-of-concept research exists. EPSS data unavailable; not in CISA KEV.
Out-of-bounds memory read in openxc/isotp-c ISO-TP Single Frame handler allows adjacent network attackers to trigger denial of service or extract sensitive information via malicious CAN frames. The vulnerability exists in all versions through commit 5a5d19245f65 (August 2021) and stems from unchecked use of a 4-bit payload length field directly as memcpy buffer size. EPSS data unavailable; no CISA KEV listing indicates no confirmed widespread exploitation, though publicly available technical analysis exists (GitHub Gist reference).
Heap-based out-of-bounds read in Open CASCADE Technology V8_0_0_rc5 OBJ file parser allows local attackers to cause denial of service or leak sensitive memory contents when victims open malicious OBJ files. The vulnerability stems from missing buffer length validation in RWObj_Reader::read() after Standard_ReadLineBuffer::ReadLine() returns minimal 1-byte buffers, leading to unsafe memory access at aLine + 2. EPSS data not available; no confirmed active exploitation or public proof-of-concept identified at time of analysis. Requires user interaction, limiting automated exploitation potential.
Heap-based out-of-bounds reads in Open CASCADE Technology (OCCT) V8_0_0_rc5 STL ASCII parser allow local attackers to trigger denial of service or disclose process memory by convincing users to open maliciously crafted STL files with extremely short lines. The vulnerability stems from improper length validation of buffers returned by Standard_ReadLineBuffer::ReadLine() before strncasecmp operations or direct byte access in RWStl_Reader::ReadAscii. CVSS score of 7.1 reflects high confidentiality and availability impact requiring user interaction. No public exploit code, active exploitation (CISA KEV), or vendor patch information identified at time of analysis, though technical details are publicly available via GitHub Gist.
Denial of service in Open CASCADE Technology (OCCT) V8_0_0_rc5 occurs when a crafted VRML V2.0 file triggers null pointer dereference during shape construction in the VrmlData_IndexedFaceSet::TShape parser. Remote unauthenticated attackers can crash applications using libTKDEVRML.so by delivering malformed VRML files, requiring no user interaction (CVSS AV:N/AC:L/PR:N/UI:N). EPSS score not available; no public exploit identified at time of analysis. Affects 3D CAD/visualization applications integrating OCCT for VRML import.
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
NULL pointer dereference in ASR Lapwing Linux's IMS client (sipuri.c) allows authenticated remote attackers to trigger service crashes and potentially execute code with changed scope. The vulnerability exists in the SIP URI parsing logic of the ASR1903 hardware platform's ims_client module. With CVSS 7.4 and scope change to Container, successful exploitation enables lateral impact beyond the vulnerable component. No CISA KEV listing or public exploit code identified at time of analysis, though EPSS data unavailable.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Remote attackers can crash Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 and disable all routing functionality by flooding the boa web server with HTTP GET requests to non-existent URIs. The attack exhausts file descriptors and memory buffers, causing kernel deadlock that kills both the web management interface and core routing services. SSVC framework confirms proof-of-concept exploit exists and the attack is fully automatable against default router configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N).
Remote unauthenticated attackers can crash the U-SPEED N300 V1.0.0 wireless router by flooding its web management interface with concurrent HTTP requests to random or non-existent endpoints, exhausting resources in the embedded Boa HTTP server until manual reboot is required. SSVC framework confirms proof-of-concept exploit code exists and the attack is fully automatable. CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable from the internet without authentication, though impact is limited to availability disruption with no data compromise.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Unauthenticated remote attackers can crash n8n workflow automation instances by flooding the MCP OAuth client registration endpoint with large payloads, exhausting server memory and causing denial of service. The vulnerability affects all n8n instances regardless of whether MCP (Model Context Protocol) access is enabled, as the endpoint lacks authentication and resource controls. Vendor-released patches (1.123.32, 2.17.4, 2.18.1) impose registration limits and disable the endpoint when MCP is turned off. No public exploit identified at time of analysis, though the attack is trivial to execute given the unauthenticated nature of the endpoint.
Remote unauthenticated denial of service crashes GoBGP routing daemon via malformed BGP UPDATE message exploiting index-out-of-bounds panic. Attackers send crafted BGP UPDATE with AS4_PATH attribute preceding AS_PATH, causing slice index mismanagement in UpdatePathAttrs4ByteAs function (internal/pkg/table/message.go). Publicly available exploit code exists with hex-level proof-of-concept payload demonstrating immediate process termination. Affects GoBGP v4.2.0 and earlier; vendor-released patch v4.3.0 available per GitHub advisory GHSA-8rxh-r2p6-7f2q. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible, low-complexity attack requiring no privileges, resulting in complete routing service disruption.
Remote denial of service via nil pointer dereference crashes GoBGP 4.3.0 when processing malformed BGP UPDATE messages containing unrecognized well-known path attributes. A single crafted UPDATE packet with an invalid Type Code (e.g., 0xEE or 0xFF) marked as well-known (Optional bit = 0) triggers a panic that terminates the entire BGP daemon process, not just the affected session. Publicly available exploit code exists with detailed proof-of-concept payloads confirmed by GitHub advisory GHSA-7235-89m6-f4px. Network-facing BGP deployments are at immediate operational risk despite CVSS 7.5, as BGP peering relationships make this trivially exploitable by any established peer.
CPU denial-of-service in the PHPOffice PhpSpreadsheet library (versions 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0) allows remote attackers to hang application worker processes by uploading a ~1.6KB crafted XLSX file. The XLSX reader trusts the row number in a `<row r="...">` attribute without bounding it against the 1,048,576 row limit, so a single `<row r="999999999"/>` element inflates the cached highest row and forces roughly one billion iterations (~144s CPU burn) whenever the application iterates rows or uses getHighestRow() as a loop bound. Publicly available exploit code exists (a full PoC in the GitHub Security Advisory); EPSS is low at 0.04% (12th percentile) and it is not in CISA KEV.
Denial of service in PhpSpreadsheet's SpreadsheetML (Excel 2003 XML) reader lets a remote unauthenticated attacker exhaust server CPU with a single ~300-byte file. The Reader\Xml component fails to bound the ss:Index row attribute against AddressRange::MAX_ROW (1,048,576), so a crafted value like ss:Index="999999999" inflates cachedHighestRow to ~1 billion; any later getRowIterator() call then attempts ~1 billion iterations. A working proof-of-concept is published in the GitHub advisory, though this is not confirmed as actively exploited and EPSS risk is negligible (0.04%).
Denial of service and network-configuration corruption in Amazon's FreeRTOS-Plus-TCP embedded IP stack (versions 4.0.0-4.2.5 and 4.3.0-4.4.0) allows an adjacent-network attacker to send a single crafted DHCPv6 packet that triggers an integer underflow in the DHCPv6 sub-option parser, corrupting the device's IPv6 address, DNS settings, and lease times and permanently freezing the IP task until a hardware reset. Exploitation requires no authentication and no user interaction on any device with DHCPv6 enabled. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none, though the technical impact is assessed as total.
Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.
Denial of service and potential heap buffer overflow in libsndfile 1.2.2's IMA ADPCM codec allows remote attackers to crash or corrupt memory in any application that parses an attacker-supplied WAV file. The flaw is an integer overflow in the frame-count calculation that was left unpatched in the WAV and close code paths after an incomplete fix for CVE-2022-33065. Publicly available exploit code exists, though EPSS is very low (0.04%, 12th percentile) and it is not on CISA KEV, indicating no observed active exploitation.
Remote unauthenticated denial-of-service in CoreDNS (all versions < 1.14.3) lets an attacker exhaust CPU and memory by flooding the DNS-over-HTTPS GET endpoint (/dns-query?dns=...) with oversized base64 payloads. Because the GET path performs URL query unescaping, base64 decoding, and DNS message unpacking before any size check, each request consumes significant resources despite ultimately returning 400 Bad Request. A detailed proof-of-concept with profiling data is published in the vendor advisory; publicly available exploit code exists, though EPSS is low (0.10%) and it is not on CISA KEV.
Unauthenticated remote denial-of-service in CoreDNS' DNS-over-QUIC (DoQ) server (versions before 1.14.3) lets an attacker exhaust memory and goroutines by opening many QUIC streams and sending only a single byte on each, stalling the DoQ length-prefix read. Because CoreDNS spawns a goroutine per accepted stream even when the configured worker_pool_size is full, and workers block indefinitely in io.ReadFull() with no per-stream read deadline, the process grows unbounded until OOM-kill. Publicly available exploit code exists (a Python reproducer demonstrating goroutine growth from 17 to over 15,000), though EPSS remains low at 0.14%; this stems from an incomplete fix/regression of CVE-2025-47950.
Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.
Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.
Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.
Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free memory corruption reported by Google's own Chrome team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none', indicating no observed exploitation despite the high technical severity.
Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.
Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.
Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.
Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Heap corruption in the Views UI component of Google Chrome on macOS (versions prior to 147.0.7727.138) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution. Rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.
Sandbox escape in Google Chrome's GPU process prior to 147.0.7727.138 lets a remote attacker corrupt memory via a use-after-free when a victim visits a crafted HTML page, potentially breaking out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to the scope change (S:C) inherent to a sandbox escape, though it requires user interaction (visiting a page). There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not on CISA KEV.
Sandbox escape in Google Chrome for Windows (versions prior to 147.0.7727.138) stems from a use-after-free in the Views UI component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader code execution on the host via a crafted HTML page. Chromium rates the internal severity as Critical, though the assigned CVSS is 7.5 due to the high attack complexity and the renderer-compromise prerequisite. This is a second-stage bug: there is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.
Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).
Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.
Resource exhaustion in OpenClaw before 2026.3.31 allows remote unauthenticated attackers to crash servers by sending malicious Microsoft Teams webhook payloads. The application parses request bodies before performing JWT validation, enabling attackers to bypass authentication and trigger denial-of-service conditions. A vendor patch is available via GitHub commit 3834d47, with no evidence of active exploitation (not in CISA KEV) and no public POC identified at time of analysis.
Denial of service in OpenClaw (pre-2026.3.28) allows remote unauthenticated attackers to exhaust server resources by flooding the application with concurrent WebSocket upgrade requests. The vulnerability stems from lack of rate-limiting and resource budgeting before authentication, enabling attackers to monopolize socket and worker thread capacity and block legitimate WebSocket clients. No active exploitation confirmed (not in CISA KEV), but the technical barrier is low given unauthenticated network access (CVSS:4.0 AV:N/AC:L/PR:N). VulnCheck reported this vulnerability with vendor advisory available on GitHub.
Authentication bypass in NVIDIA NVFlare Dashboard allows remote unauthenticated attackers to escalate privileges through user-controlled key manipulation in the authentication system. The vulnerability affects the NVIDIA Flare SDK and enables complete system compromise including arbitrary code execution, data tampering, information disclosure, and denial of service. With a CVSS score of 9.8 (critical severity) and maximum exploitability metrics (AV:N/AC:L/PR:N/UI:N), this represents a severe security flaw requiring immediate remediation, though no active exploitation (KEV) or public exploit code has been identified at time of analysis.
Integer overflow in Apache Thrift's Go TFramedTransport implementation allows remote unauthenticated attackers to crash server processes via specially crafted uint32 values. Affects all Thrift versions prior to 0.23.0 with EPSS score of 0.02% (low exploitation probability). This is one of six related vulnerabilities disclosed simultaneously affecting different Thrift language bindings (Go, Swift, Java, c_glib), indicating coordinated security audit findings. Vendor patch available in version 0.23.0 released April 2026.
Integer overflow in Apache Thrift Swift Compact Protocol implementation versions prior to 0.23.0 enables remote unauthenticated attackers to achieve partial confidentiality, integrity, and availability impact. This is one of six related vulnerabilities disclosed simultaneously affecting multiple Apache Thrift language implementations (Swift, Node.js, C++, c_glib, Go). EPSS score of 0.02% (5th percentile) indicates low current exploitation probability, with no active exploitation confirmed by CISA KEV at time of analysis. Vendor-released patch version 0.23.0 addresses this and related Thrift implementation flaws.
Apache Thrift Java TSSLTransportFactory fails to verify server hostnames in TLS connections, enabling man-in-the-middle attacks against versions prior to 0.23.0. This CWE-297 (improper certificate validation) vulnerability allows network attackers with high complexity positioning to intercept and modify encrypted communications without authentication. EPSS exploitation probability is low (0.01%, 1st percentile), with no KEV listing or public exploit code identified at time of analysis. Vendor patch available in Thrift 0.23.0.
Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 lets an unauthenticated attacker crash any GSS-API acceptor that has a NegoEx mechanism registered in /etc/gss/mech. Sending a malformed NegoEx token to an application that calls gss_accept_sec_context() triggers a NULL pointer dereference in parse_nego_message, terminating the process (CWE-476). No public exploit identified at time of analysis; EPSS is low (0.07%) and CISA SSVC lists exploitation as proof-of-concept only, with technical impact rated partial and not automatable.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
Atom table exhaustion in plug_cowboy 2.0.0-2.8.0 allows remote denial of service via HTTP/2. Unauthenticated attackers can crash the Erlang VM by sending HTTP/2 requests with unique :scheme pseudo-header values, permanently filling the non-garbage-collected atom table until the system_limit is reached. Affects only HTTP/2 connections; HTTP/1.1 is not vulnerable. CVSS 8.7 (High) with network attack vector, low complexity, and no required privileges. No active exploitation confirmed (not in CISA KEV), but exploit is trivial given the publicly documented attack mechanism in the GitHub advisory.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
Denial of service in MERCURY MIPC252W IP camera firmware 1.0.5 Build 230306 Rel.79931n allows remote unauthenticated attackers to crash the device via malformed RTSP SETUP request. Exploitation triggers a null pointer dereference in the RTSP service during Transport header parsing, forcing an automatic reboot. EPSS score of 0.01% indicates very low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis beyond the researcher's GitHub documentation.
Denial of service in Aegra, an open-source Agent Protocol server (vulnerable at commit e9a89f), lets remote unauthenticated attackers exhaust server resources by sending a crafted POST request to the /store/items/search endpoint. The flaw is classified as uncontrolled resource consumption (CWE-400) and carries CVSS 7.5 with an availability-only impact; publicly available exploit code exists via a referenced gist, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%).
Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.
Heap buffer overflow in BusyBox udhcpc6 (DHCPv6 client) allows network-adjacent attackers to achieve remote code execution or denial of service on embedded systems. The vulnerability stems from incorrect heap buffer allocation in option_to_env() when parsing D6_OPT_DNS_SERVERS options in DHCPv6 responses. Particularly dangerous on embedded devices lacking heap hardening protections. Fixed in commit 42202bf. No active exploitation confirmed (not in CISA KEV), but publicly available proof-of-concept from VulnCheck disclosure increases real-world risk for IoT and embedded deployments.
Memory exhaustion in Prometheus remote read endpoint allows unauthenticated attackers to crash the monitoring server via maliciously crafted snappy-compressed payloads. The /api/v1/read endpoint in versions prior to 3.5.3 and 3.11.3 accepts compressed request bodies without validating the declared decoded length, enabling a 5-byte payload claiming 256 MiB decoded size to trigger massive heap allocations. Concurrent requests can exhaust memory and crash the Prometheus process. EPSS data not provided; no evidence of active exploitation (not in CISA KEV). Vendor-released patches available in versions 3.5.3 and 3.11.3.
Remote denial of service in the Postfix mail transfer agent (before 3.8.16, 3.9.x before 3.9.10, and 3.10.x before 3.10.9) lets attackers crash the process through a malformed enhanced status code that ends immediately after the third numeric component with no trailing text, triggering a buffer over-read. The flaw affects availability only - no data exposure or code execution - and has no public exploit identified at time of analysis. EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none and non-automatable, consistent with a crash-only bug.
Nil-pointer dereference in Incus daemon's custom volume backup import logic allows authenticated users to crash the service by supplying a malformed backup archive containing null entries in the volume_snapshots array, enabling repeated denial of service attacks. The vulnerability exists in the CreateCustomVolumeFromBackup function which fails to validate snapshot pointers before dereferencing them during import operations. CVSS 6.5 (authenticated network access, high availability impact); no public exploit code or active exploitation reported at analysis time, but proof-of-concept demonstration included in advisory.
Nil-pointer dereference in Incus daemon's storage bucket import logic allows authenticated users to crash the daemon by submitting a malformed bucket backup archive with a missing config section in index.yaml, enabling denial of service through repeated exploitation. The vulnerability affects Incus versions prior to 7.0.0 and requires valid storage bucket feature access but no special privileges beyond authenticated user status.
Remote denial of service in Apache OpenNLP versions before 2.5.9 and 3.0.0-M3 allows unauthenticated attackers to crash JVM processes by uploading malicious .bin model files that trigger OutOfMemoryError through unbounded array allocation. Exploitation requires no authentication (AV:N/AC:L/PR:N) and affects any code path deserializing binary model files from untrusted sources. EPSS score of 0.02% (5th percentile) suggests low widespread exploitation risk, and no active exploitation or public POC has been identified at time of analysis. Vendor-released patches are available with default safeguards limiting count fields to 10 million entries.
Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL pointer dereference in mod_dav_lock, causing denial of service. The vulnerability affects only servers with mod_dav_lock enabled, a legacy module whose primary use-case (Apache Subversion < 1.2.0) is obsolete in modern deployments. CISA SSVC indicates no active exploitation, but the attack is automatable against susceptible configurations. CVSS 7.5 (High) reflects network-accessible, unauthenticated denial of service, though real-world impact is limited to the small subset of servers still running mod_dav_lock.
Denial of Service in FRRouting 10.0 through 10.6 allows remote unauthenticated attackers to crash the BGP daemon via a malformed BGP UPDATE message exploiting an integer underflow in next-hop capability processing. Upstream fix available in commit 693a2e0 but released patched version not independently confirmed. No public exploit identified at time of analysis, with EPSS score not provided suggesting low observed exploitation activity.
Remote attackers can crash GoBGP v4.3.0 by sending a malformed BGP UPDATE message that triggers an out-of-bounds read in IPv6 extended community parsing. The flaw allows unauthenticated denial of service against default configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability. Upstream fixes available via GitHub commits 362cce3e and 9ce8936.
Memory exhaustion in Bandit WebSocket server (versions 0.5.9 through 1.10.x) allows unauthenticated remote attackers to crash BEAM nodes via compression bombs when permessage-deflate is enabled. The inflate/2 function decompresses WebSocket frames without output-size limits, enabling attackers to send tiny compressed payloads (~1024:1 ratio) that expand to gigabyte-scale heap allocations. Vendor-released patch available (version 1.11.0). EPSS data not available; no public exploit identified at time of analysis. Exploitation requires non-default configuration (both server-level compress and per-upgrade compress: true options enabled), making stock Phoenix/LiveView applications unaffected.
Memory exhaustion in Bandit WebSocket server (versions 0.5.0 through 1.10.x) allows unauthenticated remote attackers to trigger denial of service by sending unbounded WebSocket continuation frames without setting the fin flag. The fragment reassembly logic accumulates payloads without checking cumulative message size, bypassing the max_frame_size limit which only applies to individual frames. Applications using Phoenix Channels or LiveView over Bandit expose this attack surface on any WebSocket endpoint. Patch available in version 1.11.0 introduces max_fragmented_message_size parameter (default 8MB). No public exploit code identified at time of analysis, but trivial to reproduce with standard WebSocket libraries.
Remote unauthenticated denial of service crashes Vanetza V2X v26.02 receivers via malformed GeoNetworking packets containing invalid ECC points. Uncaught OpenSSL exceptions from elliptic curve point validation (invalid compressed points, points not on curve) in the security layer escape through the Router::indicate() call chain, triggering std::terminate and process termination. No public exploit identified at time of analysis, though EPSS risk assessment unavailable. Attack requires only network access to the V2X receiver endpoint with no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making this a significant operational risk for deployed V2X infrastructure relying on continuous availability for vehicle safety communications.
Use-after-free in Imagination Graphics DDK GPU GLES user-space library allows authenticated remote attackers to crash the GPU render process via crafted WebGPU content. CVSS 8.1 (High) with network vector and low complexity. On platforms where the GPU process runs with elevated system privileges, successful exploitation could enable system-level compromise beyond the initial crash. EPSS and KEV data not provided; SSVC framework indicates no confirmed exploitation, non-automatable attack, but total technical impact. Vendor patches available across affected DDK versions 1.18, 23.2, 24.1-24.2, and 25.1-25.3.
Remote authenticated attackers can execute code or cause persistent denial-of-service in Imagination Technologies Graphics DDK by triggering a use-after-free in the GPU GLES render process via specially crafted WebGPU content. On platforms where the GPU driver runs with elevated system privileges, successful exploitation enables device-level compromise beyond the browser sandbox. EPSS data not available, no CISA KEV listing identified, no public POC confirmed. SSVC framework indicates no active exploitation and non-automatable attack requiring authenticated interaction.
Heap-based buffer overflow in hashcat 7.1.2 enables remote code execution or denial of service through maliciously crafted PKZIP hash files. Attackers can exploit inadequate input validation in the hex_to_binary function affecting PKZIP hash parser modules (17200, 17210, 17220, 17225, 17230) to overflow fixed-size buffers with arbitrary hex data. CVSS 9.8 reflects network-accessible attack vector requiring no authentication or user interaction, though real-world exploitation requires victim to process attacker-supplied hash files. EPSS data not available; no CISA KEV listing indicates no confirmed widespread exploitation. Public proof-of-concept exists (GitHub Gist), elevating exploitation risk for environments processing untrusted hash files.
Heap-based buffer overflow in hashcat 7.1.2's Kerberos hash parser enables remote code execution without authentication. Attacker supplies a maliciously crafted Kerberos hash file with manipulated delimiter positions to overflow the fixed-size account_info buffer during memcpy operations in module_hash_decode. The vulnerability affects multiple Kerberos-related hashcat modules due to missing upper-bound validation on account_info_len before memory copy. CVSS 9.8 with network attack vector, but real-world exploitation requires user processing the malicious file. EPSS data not available; no active exploitation confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in hashcat 7.1.2's rule processing functions enables remote code execution when processing password candidates of 128+ characters. The vulnerability stems from inadequate bounds checking in mangle_to_hex_lower() and mangle_to_hex_upper() functions that fail to account for 2x memory expansion during byte-to-hex conversion. CVSS 9.8 (critical) with network attack vector and no authentication required. Public proof-of-concept code available via GitHub gist. No CISA KEV listing suggests targeted rather than widespread exploitation despite theoretical network exploitability.
Use-after-free condition in Linux kernel writeback subsystem allows local authenticated attackers to potentially execute arbitrary code, escalate privileges, or trigger kernel crashes. The vulnerability affects Linux kernel versions 6.18.x through 7.1-rc1 and arises from improper synchronization between work queue processing and memory deallocation in inode_switch_wbs_work_fn(). Vendor patches are available across stable kernel branches (6.18.25, 7.0.2, 7.1-rc1) with low EPSS score (0.02%) indicating minimal observed exploitation activity, though the CVSS 7.8 score reflects significant impact if successfully exploited by authenticated local users.
Use-after-free in Linux kernel macb driver allows local authenticated attackers to cause denial of service or potentially escalate privileges during module removal. The vulnerability occurs in the PCI glue driver when platform_device_unregister() triggers a runtime resume callback that attempts to access already-freed clock structures. EPSS score is low (0.02%) with no evidence of active exploitation. Vendor patches are available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0).
Integer overflow in Linux kernel io_uring subsystem allows local authenticated users to trigger slab-out-of-bounds memory reads and denial of service. The vulnerability stems from improper type casting of user-supplied length values in network bundled receive/send operations, where values exceeding INT_MAX cause negative overflow leading to infinite loops and out-of-bounds array access. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Vendor patches available for affected stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0), making this a straightforward patching priority for systems running vulnerable versions with io_uring enabled.
Missing CRYPTO_ALG_ASYNC flag in Linux kernel's Tegra crypto driver causes the crypto API to incorrectly select asynchronous algorithms for synchronous-only requests, resulting in system crashes. This affects Tegra-based Linux systems (typically NVIDIA Jetson devices) running kernel versions 6.10 through early 7.0 development branches. Vendor patches are available across stable branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability, and no active exploitation or public POC has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:N) suggests network-based exploitation requiring authenticated access, though this conflicts with the technical nature of a local driver configuration bug.
Algorithmic complexity denial of service in Apache Neethi allows remote unauthenticated attackers to exhaust JVM heap memory via malicious WS-Policy documents. Specially crafted policy documents trigger exponential Cartesian cross-product expansion during normalization, generating unbounded policy alternatives that consume all available memory. Apache has released version 3.2.2 with normalization limits to prevent exploitation. EPSS data not available; no CISA KEV listing identified at time of analysis.
Denial of Service in Apache Neethi WS-Policy processor allows remote unauthenticated attackers to crash applications or cause resource exhaustion by sending crafted policy documents with circular references. The vulnerability (CVSS 7.5) triggers infinite loops or stack overflow during policy normalization when Policy A references Policy B which references Policy A. Apache released version 3.2.2 to address this flaw. With network vector, low complexity, and no authentication required (AV:N/AC:L/PR:N), this represents a readily exploitable attack surface for applications parsing untrusted WS-Policy documents, though no public exploit or active exploitation (KEV) has been identified at time of analysis.
Remote denial of service in FRRouting stable/10.0 allows unauthenticated attackers to crash the BGP daemon via malformed FlowSpec NLRI messages. The off-by-one vulnerability in bgp_flowspec_op_decode() enables out-of-bounds writes when parsing crafted BGP FlowSpec components, causing process termination. EPSS exploitation probability data not available, but SSVC marks this as automatable with partial technical impact. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting theoretical rather than actively exploited risk.
Remote code execution in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 allows unauthenticated network attackers to execute arbitrary code or crash the system by sending malformed CANswitch frames with invalid DLC (Data Length Code) values. The buffer overflow occurs in the canformat_canswitch.cpp parser module which fails to validate frame length parameters before processing, enabling memory corruption. A proof-of-concept exploit is publicly available on GitHub, and SSVC assessment indicates the vulnerability is automatable with partial technical impact, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Remote code execution in cannelloni v2.0.0 allows unauthenticated network attackers to crash the service or execute arbitrary code by sending malformed CAN FD frames that trigger buffer overflows in two separate parsing functions (parseCANFrame in parser.cpp and decodeFrame in decoder.cpp). The CVSS score of 9.8 reflects network-accessible exploitation requiring no authentication or user interaction, with complete system compromise possible. Public proof-of-concept code exists (GitHub Gist reference), elevating immediate exploitation risk despite no CISA KEV listing, suggesting targeted rather than mass exploitation scenarios.
Remote unauthenticated attackers can crash socketcand 0.4.2 daemon by sending a malformed CAN bus name that triggers a stack-based buffer overflow in the main function's socketcand.c implementation. The CVSS vector indicates network-accessible denial of service with no authentication required. A publicly available proof-of-concept exists (GitHub Gist reference), but CISA KEV status is not confirmed, and EPSS data is unavailable. The low attack complexity (AC:L) and network attack vector (AV:N) make this readily exploitable against exposed instances, though the impact is currently limited to availability (A:H) with no confirmed confidentiality or integrity impacts.
Remote code execution in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 allows network-based attackers to execute arbitrary code or crash the system without authentication. A buffer overflow in the GVRET CAN data parser (canformat_gvret.cpp) fails to validate length fields in binary frames, enabling memory corruption. CVSS 10.0 reflects unauthenticated network vector with scope change, but no public exploit or active exploitation confirmed at time of analysis. EPSS data unavailable; real-world risk depends on OVMS3 deployment exposure (typically vehicle telematics environments).
Buffer overflow in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 enables remote code execution when processing malicious PCAP files. The canformat_pcap.cpp parser fails to validate the phdr.len field, allowing attackers to overflow stack buffers and execute arbitrary code with high confidentiality, integrity, and availability impact. Public proof-of-concept code exists (GitHub Gist), though no active exploitation is confirmed by CISA KEV. SSVC assessment indicates automatable exploitation despite requiring user interaction to open crafted PCAP files.
Remote denial of service in Open-SAE-J1939 library (commit b6caf884 and prior, November 2025) allows unauthenticated attackers to crash SAE J1939 protocol implementations by sending malformed CAN frames to the J1939 bus. Exploitation is straightforward (CVSS AC:L, SSVC automatable:yes) and requires only network access to the CAN bus. No public exploit code confirmed, but GIST reference suggests proof-of-concept research exists. EPSS data unavailable; not in CISA KEV.
Out-of-bounds memory read in openxc/isotp-c ISO-TP Single Frame handler allows adjacent network attackers to trigger denial of service or extract sensitive information via malicious CAN frames. The vulnerability exists in all versions through commit 5a5d19245f65 (August 2021) and stems from unchecked use of a 4-bit payload length field directly as memcpy buffer size. EPSS data unavailable; no CISA KEV listing indicates no confirmed widespread exploitation, though publicly available technical analysis exists (GitHub Gist reference).
Heap-based out-of-bounds read in Open CASCADE Technology V8_0_0_rc5 OBJ file parser allows local attackers to cause denial of service or leak sensitive memory contents when victims open malicious OBJ files. The vulnerability stems from missing buffer length validation in RWObj_Reader::read() after Standard_ReadLineBuffer::ReadLine() returns minimal 1-byte buffers, leading to unsafe memory access at aLine + 2. EPSS data not available; no confirmed active exploitation or public proof-of-concept identified at time of analysis. Requires user interaction, limiting automated exploitation potential.
Heap-based out-of-bounds reads in Open CASCADE Technology (OCCT) V8_0_0_rc5 STL ASCII parser allow local attackers to trigger denial of service or disclose process memory by convincing users to open maliciously crafted STL files with extremely short lines. The vulnerability stems from improper length validation of buffers returned by Standard_ReadLineBuffer::ReadLine() before strncasecmp operations or direct byte access in RWStl_Reader::ReadAscii. CVSS score of 7.1 reflects high confidentiality and availability impact requiring user interaction. No public exploit code, active exploitation (CISA KEV), or vendor patch information identified at time of analysis, though technical details are publicly available via GitHub Gist.
Denial of service in Open CASCADE Technology (OCCT) V8_0_0_rc5 occurs when a crafted VRML V2.0 file triggers null pointer dereference during shape construction in the VrmlData_IndexedFaceSet::TShape parser. Remote unauthenticated attackers can crash applications using libTKDEVRML.so by delivering malformed VRML files, requiring no user interaction (CVSS AV:N/AC:L/PR:N/UI:N). EPSS score not available; no public exploit identified at time of analysis. Affects 3D CAD/visualization applications integrating OCCT for VRML import.
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
NULL pointer dereference in ASR Lapwing Linux's IMS client (sipuri.c) allows authenticated remote attackers to trigger service crashes and potentially execute code with changed scope. The vulnerability exists in the SIP URI parsing logic of the ASR1903 hardware platform's ims_client module. With CVSS 7.4 and scope change to Container, successful exploitation enables lateral impact beyond the vulnerable component. No CISA KEV listing or public exploit code identified at time of analysis, though EPSS data unavailable.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Remote attackers can crash Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 and disable all routing functionality by flooding the boa web server with HTTP GET requests to non-existent URIs. The attack exhausts file descriptors and memory buffers, causing kernel deadlock that kills both the web management interface and core routing services. SSVC framework confirms proof-of-concept exploit exists and the attack is fully automatable against default router configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N).
Remote unauthenticated attackers can crash the U-SPEED N300 V1.0.0 wireless router by flooding its web management interface with concurrent HTTP requests to random or non-existent endpoints, exhausting resources in the embedded Boa HTTP server until manual reboot is required. SSVC framework confirms proof-of-concept exploit code exists and the attack is fully automatable. CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable from the internet without authentication, though impact is limited to availability disruption with no data compromise.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Unauthenticated remote attackers can crash n8n workflow automation instances by flooding the MCP OAuth client registration endpoint with large payloads, exhausting server memory and causing denial of service. The vulnerability affects all n8n instances regardless of whether MCP (Model Context Protocol) access is enabled, as the endpoint lacks authentication and resource controls. Vendor-released patches (1.123.32, 2.17.4, 2.18.1) impose registration limits and disable the endpoint when MCP is turned off. No public exploit identified at time of analysis, though the attack is trivial to execute given the unauthenticated nature of the endpoint.
Remote unauthenticated denial of service crashes GoBGP routing daemon via malformed BGP UPDATE message exploiting index-out-of-bounds panic. Attackers send crafted BGP UPDATE with AS4_PATH attribute preceding AS_PATH, causing slice index mismanagement in UpdatePathAttrs4ByteAs function (internal/pkg/table/message.go). Publicly available exploit code exists with hex-level proof-of-concept payload demonstrating immediate process termination. Affects GoBGP v4.2.0 and earlier; vendor-released patch v4.3.0 available per GitHub advisory GHSA-8rxh-r2p6-7f2q. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible, low-complexity attack requiring no privileges, resulting in complete routing service disruption.
Remote denial of service via nil pointer dereference crashes GoBGP 4.3.0 when processing malformed BGP UPDATE messages containing unrecognized well-known path attributes. A single crafted UPDATE packet with an invalid Type Code (e.g., 0xEE or 0xFF) marked as well-known (Optional bit = 0) triggers a panic that terminates the entire BGP daemon process, not just the affected session. Publicly available exploit code exists with detailed proof-of-concept payloads confirmed by GitHub advisory GHSA-7235-89m6-f4px. Network-facing BGP deployments are at immediate operational risk despite CVSS 7.5, as BGP peering relationships make this trivially exploitable by any established peer.
CPU denial-of-service in the PHPOffice PhpSpreadsheet library (versions 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0) allows remote attackers to hang application worker processes by uploading a ~1.6KB crafted XLSX file. The XLSX reader trusts the row number in a `<row r="...">` attribute without bounding it against the 1,048,576 row limit, so a single `<row r="999999999"/>` element inflates the cached highest row and forces roughly one billion iterations (~144s CPU burn) whenever the application iterates rows or uses getHighestRow() as a loop bound. Publicly available exploit code exists (a full PoC in the GitHub Security Advisory); EPSS is low at 0.04% (12th percentile) and it is not in CISA KEV.
Denial of service in PhpSpreadsheet's SpreadsheetML (Excel 2003 XML) reader lets a remote unauthenticated attacker exhaust server CPU with a single ~300-byte file. The Reader\Xml component fails to bound the ss:Index row attribute against AddressRange::MAX_ROW (1,048,576), so a crafted value like ss:Index="999999999" inflates cachedHighestRow to ~1 billion; any later getRowIterator() call then attempts ~1 billion iterations. A working proof-of-concept is published in the GitHub advisory, though this is not confirmed as actively exploited and EPSS risk is negligible (0.04%).
Denial of service and network-configuration corruption in Amazon's FreeRTOS-Plus-TCP embedded IP stack (versions 4.0.0-4.2.5 and 4.3.0-4.4.0) allows an adjacent-network attacker to send a single crafted DHCPv6 packet that triggers an integer underflow in the DHCPv6 sub-option parser, corrupting the device's IPv6 address, DNS settings, and lease times and permanently freezing the IP task until a hardware reset. Exploitation requires no authentication and no user interaction on any device with DHCPv6 enabled. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none, though the technical impact is assessed as total.
Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.
Denial of service and potential heap buffer overflow in libsndfile 1.2.2's IMA ADPCM codec allows remote attackers to crash or corrupt memory in any application that parses an attacker-supplied WAV file. The flaw is an integer overflow in the frame-count calculation that was left unpatched in the WAV and close code paths after an incomplete fix for CVE-2022-33065. Publicly available exploit code exists, though EPSS is very low (0.04%, 12th percentile) and it is not on CISA KEV, indicating no observed active exploitation.
Remote unauthenticated denial-of-service in CoreDNS (all versions < 1.14.3) lets an attacker exhaust CPU and memory by flooding the DNS-over-HTTPS GET endpoint (/dns-query?dns=...) with oversized base64 payloads. Because the GET path performs URL query unescaping, base64 decoding, and DNS message unpacking before any size check, each request consumes significant resources despite ultimately returning 400 Bad Request. A detailed proof-of-concept with profiling data is published in the vendor advisory; publicly available exploit code exists, though EPSS is low (0.10%) and it is not on CISA KEV.
Unauthenticated remote denial-of-service in CoreDNS' DNS-over-QUIC (DoQ) server (versions before 1.14.3) lets an attacker exhaust memory and goroutines by opening many QUIC streams and sending only a single byte on each, stalling the DoQ length-prefix read. Because CoreDNS spawns a goroutine per accepted stream even when the configured worker_pool_size is full, and workers block indefinitely in io.ReadFull() with no per-stream read deadline, the process grows unbounded until OOM-kill. Publicly available exploit code exists (a Python reproducer demonstrating goroutine growth from 17 to over 15,000), though EPSS remains low at 0.14%; this stems from an incomplete fix/regression of CVE-2025-47950.
Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.
Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.
Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.
Heap corruption in Google Chrome's Cast component (versions prior to 147.0.7727.138) allows an attacker positioned on the same local network segment to trigger a use-after-free via malicious network traffic, potentially leading to code execution within the browser process. The flaw was reported internally by the Chrome team and carries a High Chromium severity, but there is no public exploit identified at time of analysis and EPSS scores exploitation probability at effectively 0%. It is not listed in CISA KEV, and CISA's SSVC assessment marks exploitation as none and the attack as not automatable.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free memory corruption reported by Google's own Chrome team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none', indicating no observed exploitation despite the high technical severity.
Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.
Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.
Sandboxed remote code execution in Google Chrome's Cast component affects all desktop builds prior to 147.0.7727.138, where a CWE-416 use-after-free lets an attacker on the same local network segment run arbitrary code inside the Chromium sandbox by sending malicious network traffic. Chromium rates the flaw High severity, but SSVC records no observed exploitation and EPSS is 0.00%, and no public exploit has been identified at time of analysis. Google has shipped a fixed Stable channel build.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.
Heap corruption in the GPU component of Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process escalate impact via a use-after-free triggered by a crafted HTML page. This is a High-severity Chromium memory-corruption bug reported internally by Chrome, with a vendor patch shipped in the April 2026 stable channel update and no public exploit identified at time of analysis. EPSS is minimal (0.01%) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Heap corruption in the Views UI component of Google Chrome on macOS (versions prior to 147.0.7727.138) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution. Rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.
Sandbox escape in Google Chrome's GPU process prior to 147.0.7727.138 lets a remote attacker corrupt memory via a use-after-free when a victim visits a crafted HTML page, potentially breaking out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to the scope change (S:C) inherent to a sandbox escape, though it requires user interaction (visiting a page). There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not on CISA KEV.
Sandbox escape in Google Chrome for Windows (versions prior to 147.0.7727.138) stems from a use-after-free in the Views UI component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader code execution on the host via a crafted HTML page. Chromium rates the internal severity as Critical, though the assigned CVSS is 7.5 due to the high attack complexity and the renderer-compromise prerequisite. This is a second-stage bug: there is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.
Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).
Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.
Resource exhaustion in OpenClaw before 2026.3.31 allows remote unauthenticated attackers to crash servers by sending malicious Microsoft Teams webhook payloads. The application parses request bodies before performing JWT validation, enabling attackers to bypass authentication and trigger denial-of-service conditions. A vendor patch is available via GitHub commit 3834d47, with no evidence of active exploitation (not in CISA KEV) and no public POC identified at time of analysis.
Denial of service in OpenClaw (pre-2026.3.28) allows remote unauthenticated attackers to exhaust server resources by flooding the application with concurrent WebSocket upgrade requests. The vulnerability stems from lack of rate-limiting and resource budgeting before authentication, enabling attackers to monopolize socket and worker thread capacity and block legitimate WebSocket clients. No active exploitation confirmed (not in CISA KEV), but the technical barrier is low given unauthenticated network access (CVSS:4.0 AV:N/AC:L/PR:N). VulnCheck reported this vulnerability with vendor advisory available on GitHub.
Authentication bypass in NVIDIA NVFlare Dashboard allows remote unauthenticated attackers to escalate privileges through user-controlled key manipulation in the authentication system. The vulnerability affects the NVIDIA Flare SDK and enables complete system compromise including arbitrary code execution, data tampering, information disclosure, and denial of service. With a CVSS score of 9.8 (critical severity) and maximum exploitability metrics (AV:N/AC:L/PR:N/UI:N), this represents a severe security flaw requiring immediate remediation, though no active exploitation (KEV) or public exploit code has been identified at time of analysis.
Integer overflow in Apache Thrift's Go TFramedTransport implementation allows remote unauthenticated attackers to crash server processes via specially crafted uint32 values. Affects all Thrift versions prior to 0.23.0 with EPSS score of 0.02% (low exploitation probability). This is one of six related vulnerabilities disclosed simultaneously affecting different Thrift language bindings (Go, Swift, Java, c_glib), indicating coordinated security audit findings. Vendor patch available in version 0.23.0 released April 2026.
Integer overflow in Apache Thrift Swift Compact Protocol implementation versions prior to 0.23.0 enables remote unauthenticated attackers to achieve partial confidentiality, integrity, and availability impact. This is one of six related vulnerabilities disclosed simultaneously affecting multiple Apache Thrift language implementations (Swift, Node.js, C++, c_glib, Go). EPSS score of 0.02% (5th percentile) indicates low current exploitation probability, with no active exploitation confirmed by CISA KEV at time of analysis. Vendor-released patch version 0.23.0 addresses this and related Thrift implementation flaws.
Apache Thrift Java TSSLTransportFactory fails to verify server hostnames in TLS connections, enabling man-in-the-middle attacks against versions prior to 0.23.0. This CWE-297 (improper certificate validation) vulnerability allows network attackers with high complexity positioning to intercept and modify encrypted communications without authentication. EPSS exploitation probability is low (0.01%, 1st percentile), with no KEV listing or public exploit code identified at time of analysis. Vendor patch available in Thrift 0.23.0.
Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 lets an unauthenticated attacker crash any GSS-API acceptor that has a NegoEx mechanism registered in /etc/gss/mech. Sending a malformed NegoEx token to an application that calls gss_accept_sec_context() triggers a NULL pointer dereference in parse_nego_message, terminating the process (CWE-476). No public exploit identified at time of analysis; EPSS is low (0.07%) and CISA SSVC lists exploitation as proof-of-concept only, with technical impact rated partial and not automatable.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
Atom table exhaustion in plug_cowboy 2.0.0-2.8.0 allows remote denial of service via HTTP/2. Unauthenticated attackers can crash the Erlang VM by sending HTTP/2 requests with unique :scheme pseudo-header values, permanently filling the non-garbage-collected atom table until the system_limit is reached. Affects only HTTP/2 connections; HTTP/1.1 is not vulnerable. CVSS 8.7 (High) with network attack vector, low complexity, and no required privileges. No active exploitation confirmed (not in CISA KEV), but exploit is trivial given the publicly documented attack mechanism in the GitHub advisory.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
Denial of service in MERCURY MIPC252W IP camera firmware 1.0.5 Build 230306 Rel.79931n allows remote unauthenticated attackers to crash the device via malformed RTSP SETUP request. Exploitation triggers a null pointer dereference in the RTSP service during Transport header parsing, forcing an automatic reboot. EPSS score of 0.01% indicates very low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis beyond the researcher's GitHub documentation.
Denial of service in Aegra, an open-source Agent Protocol server (vulnerable at commit e9a89f), lets remote unauthenticated attackers exhaust server resources by sending a crafted POST request to the /store/items/search endpoint. The flaw is classified as uncontrolled resource consumption (CWE-400) and carries CVSS 7.5 with an availability-only impact; publicly available exploit code exists via a referenced gist, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%).
Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.