Denial Of Service
Monthly
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Unthrottled resource allocation in Microsoft.AspNetCore.OData exposes ASP.NET Core applications to network-based denial of service by unauthenticated remote attackers. The root cause (CWE-770) allows crafted OData protocol requests - such as deeply nested $expand, expensive $filter expressions, or unbounded batch operations - to consume server memory or CPU without limit until the service becomes unavailable. Microsoft has released a patch via the MSRC advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Denial of service in Snipe-IT before 8.7.1 allows authenticated users to exhaust PHP worker CPU by submitting arbitrarily large values in the note field of the POST /account/accept/{acceptance} endpoint. The unbounded input is passed directly to synchronous CommonMark markdown rendering during acceptance notification email generation, consuming worker CPU proportional to input size on every request. No public exploit code has been identified at time of analysis, but the attack is straightforward for any authenticated user and requires no special privileges beyond a valid account.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Use-after-free memory corruption in Arm's Bifrost, Valhall, and 5th Gen GPU userspace drivers allows a local non-privileged process - including through browser-exposed WebGL or WebGPU operations - to access already-freed memory regions, achieving full confidentiality, integrity, and availability impact. The flaw spans driver revisions from r42p0 through r55p0 across all three GPU families, covering a substantial portion of the Android Mali GPU ecosystem deployed in MediaTek and Samsung Exynos SoCs. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), but the WebGL/WebGPU trigger path is a notable attack surface reduction that warrants prompt patching on affected devices.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged process to access deallocated kernel memory through valid GPU memory processing operations, resulting in full confidentiality, integrity, and availability compromise (CVSS C:H/I:H/A:H). The flaw spans broad version ranges across all three driver families from r44p0 through r54p3/r55p0, affecting a large population of devices built on Arm Mali GPU hardware. No active exploitation is confirmed at time of analysis (EPSS 0.14%, no CISA KEV listing), but UAF vulnerabilities in kernel-mode GPU drivers are a well-established and historically weaponized local privilege escalation vector on Android and Linux platforms.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed GPU memory, yielding full confidentiality, integrity, and availability impact within the kernel driver context. Affected revisions span a wide range across all three driver families - from r49p3 through r55p0 depending on the product line - placing a large population of Android and embedded Arm devices in scope. No public exploit code exists at time of analysis, and EPSS sits at 0.14% (4th percentile), though the low-complexity local attack surface characteristic of GPU driver UAFs has historically attracted sophisticated actors targeting mobile platforms.
Use-after-free in Arm's Valhall and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed kernel memory by submitting valid GPU processing operations, with potential for full system compromise across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H). Both driver families are affected from r50p0 through r54p3 and at r55p0, covering a wide swath of devices - notably Android smartphones and embedded SoCs - that rely on these GPU drivers. No active exploitation is confirmed (EPSS 0.14%, 4th percentile; no CISA KEV listing) at time of analysis.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Denial of service in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an unauthenticated attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet targeting the btm_acl_handle() function. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the Bluetooth stack's ACL connection handler, causing the firmware to exhaust resources or reach an unhandled state upon receipt of malformed input. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.17%, indicating low current threat activity.
Unauthenticated adjacent-network exploitation of `l2cap_handle_data()` in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a crafted L2CAP packet, causing a Denial of Service. The assigned CVSS vector reports C:H/I:H/A:H - substantially exceeding the described DoS-only impact - suggesting the underlying memory corruption may carry code execution potential not explicitly confirmed in the advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow database storage and heap memory without bound when the Client ID Metadata Document (CIMD) feature is enabled. The /authorize endpoint's resolve_client/3 function fetches and permanently upserts one database row per distinct URL-shaped client_id, with no row cap, no TTL-based expiry, and no field-length limit; additionally, fetched documents enter CIMD.Cache before validation, meaning even rejected documents consume cache memory until their TTL expires. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Unthrottled resource allocation in Microsoft.AspNetCore.OData exposes ASP.NET Core applications to network-based denial of service by unauthenticated remote attackers. The root cause (CWE-770) allows crafted OData protocol requests - such as deeply nested $expand, expensive $filter expressions, or unbounded batch operations - to consume server memory or CPU without limit until the service becomes unavailable. Microsoft has released a patch via the MSRC advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Denial of service in Snipe-IT before 8.7.1 allows authenticated users to exhaust PHP worker CPU by submitting arbitrarily large values in the note field of the POST /account/accept/{acceptance} endpoint. The unbounded input is passed directly to synchronous CommonMark markdown rendering during acceptance notification email generation, consuming worker CPU proportional to input size on every request. No public exploit code has been identified at time of analysis, but the attack is straightforward for any authenticated user and requires no special privileges beyond a valid account.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Use-after-free memory corruption in Arm's Bifrost, Valhall, and 5th Gen GPU userspace drivers allows a local non-privileged process - including through browser-exposed WebGL or WebGPU operations - to access already-freed memory regions, achieving full confidentiality, integrity, and availability impact. The flaw spans driver revisions from r42p0 through r55p0 across all three GPU families, covering a substantial portion of the Android Mali GPU ecosystem deployed in MediaTek and Samsung Exynos SoCs. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), but the WebGL/WebGPU trigger path is a notable attack surface reduction that warrants prompt patching on affected devices.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged process to access deallocated kernel memory through valid GPU memory processing operations, resulting in full confidentiality, integrity, and availability compromise (CVSS C:H/I:H/A:H). The flaw spans broad version ranges across all three driver families from r44p0 through r54p3/r55p0, affecting a large population of devices built on Arm Mali GPU hardware. No active exploitation is confirmed at time of analysis (EPSS 0.14%, no CISA KEV listing), but UAF vulnerabilities in kernel-mode GPU drivers are a well-established and historically weaponized local privilege escalation vector on Android and Linux platforms.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed GPU memory, yielding full confidentiality, integrity, and availability impact within the kernel driver context. Affected revisions span a wide range across all three driver families - from r49p3 through r55p0 depending on the product line - placing a large population of Android and embedded Arm devices in scope. No public exploit code exists at time of analysis, and EPSS sits at 0.14% (4th percentile), though the low-complexity local attack surface characteristic of GPU driver UAFs has historically attracted sophisticated actors targeting mobile platforms.
Use-after-free in Arm's Valhall and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed kernel memory by submitting valid GPU processing operations, with potential for full system compromise across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H). Both driver families are affected from r50p0 through r54p3 and at r55p0, covering a wide swath of devices - notably Android smartphones and embedded SoCs - that rely on these GPU drivers. No active exploitation is confirmed (EPSS 0.14%, 4th percentile; no CISA KEV listing) at time of analysis.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Denial of service in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an unauthenticated attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet targeting the btm_acl_handle() function. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the Bluetooth stack's ACL connection handler, causing the firmware to exhaust resources or reach an unhandled state upon receipt of malformed input. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.17%, indicating low current threat activity.
Unauthenticated adjacent-network exploitation of `l2cap_handle_data()` in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a crafted L2CAP packet, causing a Denial of Service. The assigned CVSS vector reports C:H/I:H/A:H - substantially exceeding the described DoS-only impact - suggesting the underlying memory corruption may carry code execution potential not explicitly confirmed in the advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow database storage and heap memory without bound when the Client ID Metadata Document (CIMD) feature is enabled. The /authorize endpoint's resolve_client/3 function fetches and permanently upserts one database row per distinct URL-shaped client_id, with no row cap, no TTL-based expiry, and no field-length limit; additionally, fetched documents enter CIMD.Cache before validation, meaning even rejected documents consume cache memory until their TTL expires. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.