Denial Of Service
Monthly
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. [CVSS 7.5 HIGH]
gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. [CVSS 3.3 LOW]
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. [CVSS 3.3 LOW]
A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F-TEID Handler. [CVSS 3.3 LOW]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inode removal leading to a debug assert trigger (that is disabled by default), NULL pointer dereference (handled differently depending on the target architecture), or in general, a Denial of Service. [CVSS 6.5 MEDIUM]
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). [CVSS 4.9 MEDIUM]
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash:. No vendor patch available.
Denial of service in OMEC UPF v2.1.3-dev and earlier allows remote attackers with low privileges to crash the user plane function via a crafted PFCP Session Establishment Request. Public exploit code exists, but the low EPSS score (0.06%) and required authentication limit immediate risk. No active exploitation has been confirmed.
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Linux kernel iomap subsystem fails to allocate the s_dio_done_wq workqueue for asynchronous read operations, causing read error completions deferred by commit 222f2c7c6d14 to lack proper execution context and potentially leading to information disclosure or system instability. The vulnerability affects Linux kernel versions where the read error completion deferral was implemented without corresponding workqueue allocation for async reads. With an EPSS score of 0.01% and no evidence of active exploitation, this is a low-probability but correctness-critical issue affecting async I/O error handling on affected kernel versions.
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
TLS renegotiation exhaustion in Keycloak allows unauthenticated remote denial of service via repeated client-initiated TLS 1.2 renegotiation requests that drain CPU resources. Affects Red Hat Single Sign-On deployments using TLS 1.2 with client renegotiation enabled. EPSS exploitation probability and KEV status not available at analysis time; CVSS 7.5 (High) reflects network-accessible attack with low complexity but availability impact only. Red Hat has issued multiple security advisories (RHSA-2025:18254, 18255, 18889, 18890) addressing this flaw.
Remote denial of service in eProsima Fast-DDS v3.3.0 allows unauthenticated network attackers to crash affected processes by sending crafted input that triggers an integer overflow (CWE-190). Fast-DDS is the default DDS middleware in ROS 2, so exploitation can take down robotics and distributed control nodes without any credentials or user interaction. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.41%, 33rd percentile) and the CVE is not listed in CISA KEV.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify, a TypeScript library for building ActivityPub federated servers, where maliciously crafted HTML responses can cause catastrophic backtracking in the document loader's HTML parsing regex. The vulnerability affects versions prior to 1.6.13, 1.7.14, 1.8.15, and 1.9.2, allowing remote attackers to cause denial of service without authentication. A public proof-of-concept exploit is available, though the EPSS score of 0.13% indicates relatively low exploitation likelihood in the wild.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Linux kernel AMD platform management controller (PMC) driver lacks Van Gogh SoC suspend handler support, preventing S0ix suspend operations on affected devices and causing GPU driver crashes during resume due to power management failures. ASUS ROG Ally (non-X) handheld gaming devices are directly impacted. Local attackers or unprivileged users can trigger denial of service by attempting system suspend, rendering the device unresponsive and forcing a hard reboot. The vulnerability carries low exploitation probability (EPSS 0.03%) but affects a specific consumer hardware class; upstream patches are available in stable kernel branches.
Null pointer dereference in WebAssembly Binaryen up to version 125 allows local authenticated users to cause denial of service by manipulating the Index argument in IRBuilder::makeLocalGet, IRBuilder::makeLocalSet, or IRBuilder::makeLocalTee functions. Public exploit code exists, though real-world impact is minimal given the very low EPSS score (0.03%, 7th percentile) and local-access-only attack vector. This vulnerability is low-severity and unlikely to be prioritized for rapid patching in most environments.
Reachable assertion in Open5GS up to version 2.7.6 affects the PFCP context management functions (PDR, FAR, URR, QER) in lib/pfcp/context.c, allowing remote attackers to trigger a denial of service condition via crafted PFCP messages. The vulnerability requires high attack complexity and has low availability impact, but publicly available exploit code exists. CVSS 2.9 / EPSS 0.14% indicates low real-world exploitation probability despite public POC.
Null pointer dereference in Open5GS up to version 2.7.5 allows remote authenticated attackers to cause denial of service by sending manipulated PFCP (Packet Forwarding Control Protocol) packets that trigger improper handling in the FAR-ID handler component. The vulnerability requires high attack complexity and authenticated access, limiting real-world exploitation despite publicly available proof-of-concept code and a low CVSS score of 1.3 reflecting restricted impact scope.
Null pointer dereference in OFFIS DCMTK up to version 3.6.9 within the DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest functions in dcmqrscp causes denial of service. The vulnerability requires local access with low privilege level and results in availability impact through service crash. No public exploit code is confirmed, and EPSS exploitation probability is extremely low at 0.04%, indicating this is a low-priority reliability issue rather than an active security threat.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Safari and Apple operating systems contain a race condition that crashes the rendering process when processing maliciously crafted web content, affecting Safari 26.2 and earlier, iOS 18.7.3 and earlier, iPadOS 18.7.3 and earlier, macOS Tahoe 26.2 and earlier, tvOS 26.2 and earlier, visionOS 26.2 and earlier, and watchOS 26.2 and earlier. The vulnerability requires user interaction (clicking a malicious link or visiting a hostile website) and has high attack complexity, resulting in denial of service through process crash rather than data compromise. No public exploit code has been identified, EPSS exploitation probability is very low at 0.12%, and Apple has released patched versions across all affected platforms.
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in Ningyuanda TC155 firmware 57.0.2.0 via malformed RTSP requests to an unauthenticated RTSP service allows local network attackers to crash or degrade the device without authentication. Publicly available exploit code exists; the vendor did not respond to early disclosure notification. CVSS score of 2.1 reflects the low severity due to limited attack surface (local network only) and availability impact alone, but real-world risk depends on device deployment context and exposure to untrusted local networks.
Local denial of service in cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) 6.0.4 for Android: the plugin registers an exported broadcast receiver (nl.xservices.plugins.ShareChooserPendingIntent) that dereferences Intent.EXTRA_CHOSEN_COMPONENT without a null check, so any other app on the device can crash the host application by sending a crafted ACTION_SEND broadcast without that extra. The flaw requires no permissions and no user interaction, and is reachable only on affected Android builds, so the impact is limited to availability (repeated application-level crashes) rather than data loss or code execution. Exploit code and a public write-up exist, but there is no evidence of this being exploited in the wild beyond proof-of-concept demonstration, and no CISA KEV listing.
Unauthenticated denial-of-service in a Rockwell Automation controller allows remote attackers to trigger a hard fault by sending malformed CIP (Common Industrial Protocol) packets over the network, rendering the controller completely unresponsive. The device displays a solid red Fault LED and requires a physical power cycle followed by manual fault-code clearing (0xF019) before returning to operational state. Discovered during fuzzing, this vulnerability targets OT/ICS environments where controller availability is safety-critical; no active exploitation or public exploit code has been identified at time of analysis.
Rockwell Automation Micro850 and Micro870 programmable logic controllers enter a recoverable fault state (fault code 0xFE60) when their IPv6 stack processes multiple malformed packets from an adjacent network segment. The impact is purely an availability disruption requiring manual operator intervention to clear the fault - no confidentiality or integrity compromise occurs. This is particularly significant in OT/ICS environments where controller downtime can halt industrial processes, though the fault is described as recoverable rather than bricking the device.
Memory corruption in Apple operating systems due to insufficient bounds checking allows local authenticated users to cause denial of service through malicious data processing, affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability requires local access and user interaction, with no public exploit identified; EPSS score of 0.02% indicates minimal real-world exploitation probability despite the assigned CVSS score of 2.8.
Use-after-free memory corruption in Apple WebKit allows remote attackers to crash Safari and iOS/iPadOS applications via maliciously crafted web content, resulting in denial of service. The vulnerability affects Safari 26.2, iOS 18.7.2 and 26.2, iPadOS 18.7.2 and 26.2, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited; however, the network-accessible attack vector and low complexity make it a moderate priority despite the low EPSS score.
Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.
Denial-of-service vulnerability in Apple macOS allows local authenticated applications to crash the system or specific services through improper input validation. Affects macOS Sequoia (before 15.7.3), Sonoma (before 14.8.3), and Tahoe (before 26.2). Attack requires local access and low privileges but no user interaction; however, real-world risk is minimal with EPSS probability of 0.02% and no public exploit identified.
Memory corruption in macOS kernel allows authenticated local users to execute arbitrary code or crash the system. Apple fixed the vulnerability via improved memory handling in macOS Sequoia 15.7.4, Sonoma 14.8.4, and Tahoe 26.1. With CVSS 7.8 (High severity) reflecting local attack vector requiring low privileges, and EPSS at 0.01% (2nd percentile), this represents a moderate real-world risk despite high CVSS scoring. No public exploit identified at time of analysis, and no evidence of active exploitation (not in CISA KEV).
Use-after-free vulnerability in whisper.cpp up to version 1.8.2 affects the read_audio_data function in common-whisper.cpp, allowing local authenticated attackers to trigger memory corruption with limited confidentiality and integrity impact. The flaw requires local access and valid user privileges on the system, with publicly available exploit code currently circulating; however, the extremely low EPSS score (0.03%, 7th percentile) and minimal CVSS severity (1.9) suggest limited real-world exploitability despite public proof-of-concept availability.
Servify Express, a Node.js package for starting Express servers, contains a denial of service vulnerability caused by the absence of size limits on JSON request bodies parsed by express.json(). Attackers can exploit this by sending extremely large payloads to cause memory exhaustion and crash the application process. With an EPSS score of 0.07% (21st percentile), active exploitation remains low-probability, though a patch is available and the vulnerability affects any internet-facing application using affected versions.
Local code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a user opens a maliciously crafted .ctl project file, triggering a use-after-free condition (CWE-416) in the parser. The flaw was reported by ICS-CERT (DHS) and documented in CISA ICS advisory ICSA-25-345-03, but there is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.
Denial of service in the Bluetooth firmware of the JXL 9-inch Car Android Double Din Player (Android v12.0) lets an attacker within Bluetooth range crash the head unit by sending a malformed Link Manager Protocol (LMP) packet. The flaw sits in the low-level Bluetooth baseband/link layer, so no pairing or user interaction is needed to disrupt availability of the in-vehicle infotainment system. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%, 20th percentile), consistent with a niche automotive product rather than a mass-exploited target.
Cross-site request forgery in 1Panel (versions 1.10.33 through 2.0.15) lets a remote attacker change the TCP port the web management service listens on by luring an authenticated administrator to a malicious webpage. Because the port-change endpoint has no anti-CSRF token or Origin/Referer checks, the victim's browser silently replays valid session cookies, moving the panel off its expected port and causing loss of access, denial of service, or unintended exposure on an attacker-chosen port. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially craftable given the described missing defenses.
Account lockout denial-of-service in 1Panel (versions 1.10.33 through 2.0.15) allows a remote attacker to forcibly change an authenticated victim's username via a cross-site request forgery flaw in the Change Username endpoint at /settings/panel. Because the endpoint lacks anti-CSRF tokens and Origin/Referer validation, a victim who visits a malicious page while logged in unknowingly submits a username change with valid session cookies, after which they are logged out and locked out of their account. No public exploit identified at time of analysis; disclosed via a VulnCheck advisory with no CISA KEV listing and no EPSS data supplied.
Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVariant parser by supplying maliciously crafted serialized/text input, resulting in denial of service and potentially arbitrary code execution. Any application linking GLib that deserializes untrusted GVariant data is exposed, which spans broad swaths of the Linux desktop and system stack across Red Hat Enterprise Linux 7-10 and SUSE. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.26%, 49th percentile) despite the 9.8 CVSS, indicating the headline severity is not yet matched by observed exploitation interest.
Local code execution in Microsoft Office (365 Apps, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) stems from a use-after-free memory corruption flaw tracked as CVE-2025-62557. An attacker who entices a user to open a crafted document can achieve arbitrary code execution with the privileges of the current user, with no public exploit identified at time of analysis. The CVSS 8.4 rating reflects high impact across confidentiality, integrity, and availability despite the local attack vector.
OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.
A serialization bug in matrix-sdk-base allows remote attackers to cause denial-of-service by sending rooms with custom m.room.join_rules values, which stalls the sync process and prevents all room processing. The vulnerability affects matrix-sdk-base versions 0.14.1 and prior and has a high availability impact (CVSS 7.5) with a patch available in version 0.16.0. With a low EPSS score of 0.06% and no KEV listing, this represents a moderate real-world risk primarily concerning service availability rather than active exploitation.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. [CVSS 7.5 HIGH]
gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. [CVSS 3.3 LOW]
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. [CVSS 3.3 LOW]
A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F-TEID Handler. [CVSS 3.3 LOW]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inode removal leading to a debug assert trigger (that is disabled by default), NULL pointer dereference (handled differently depending on the target architecture), or in general, a Denial of Service. [CVSS 6.5 MEDIUM]
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). [CVSS 4.9 MEDIUM]
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash:. No vendor patch available.
Denial of service in OMEC UPF v2.1.3-dev and earlier allows remote attackers with low privileges to crash the user plane function via a crafted PFCP Session Establishment Request. Public exploit code exists, but the low EPSS score (0.06%) and required authentication limit immediate risk. No active exploitation has been confirmed.
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Linux kernel iomap subsystem fails to allocate the s_dio_done_wq workqueue for asynchronous read operations, causing read error completions deferred by commit 222f2c7c6d14 to lack proper execution context and potentially leading to information disclosure or system instability. The vulnerability affects Linux kernel versions where the read error completion deferral was implemented without corresponding workqueue allocation for async reads. With an EPSS score of 0.01% and no evidence of active exploitation, this is a low-probability but correctness-critical issue affecting async I/O error handling on affected kernel versions.
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
TLS renegotiation exhaustion in Keycloak allows unauthenticated remote denial of service via repeated client-initiated TLS 1.2 renegotiation requests that drain CPU resources. Affects Red Hat Single Sign-On deployments using TLS 1.2 with client renegotiation enabled. EPSS exploitation probability and KEV status not available at analysis time; CVSS 7.5 (High) reflects network-accessible attack with low complexity but availability impact only. Red Hat has issued multiple security advisories (RHSA-2025:18254, 18255, 18889, 18890) addressing this flaw.
Remote denial of service in eProsima Fast-DDS v3.3.0 allows unauthenticated network attackers to crash affected processes by sending crafted input that triggers an integer overflow (CWE-190). Fast-DDS is the default DDS middleware in ROS 2, so exploitation can take down robotics and distributed control nodes without any credentials or user interaction. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.41%, 33rd percentile) and the CVE is not listed in CISA KEV.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify, a TypeScript library for building ActivityPub federated servers, where maliciously crafted HTML responses can cause catastrophic backtracking in the document loader's HTML parsing regex. The vulnerability affects versions prior to 1.6.13, 1.7.14, 1.8.15, and 1.9.2, allowing remote attackers to cause denial of service without authentication. A public proof-of-concept exploit is available, though the EPSS score of 0.13% indicates relatively low exploitation likelihood in the wild.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Linux kernel AMD platform management controller (PMC) driver lacks Van Gogh SoC suspend handler support, preventing S0ix suspend operations on affected devices and causing GPU driver crashes during resume due to power management failures. ASUS ROG Ally (non-X) handheld gaming devices are directly impacted. Local attackers or unprivileged users can trigger denial of service by attempting system suspend, rendering the device unresponsive and forcing a hard reboot. The vulnerability carries low exploitation probability (EPSS 0.03%) but affects a specific consumer hardware class; upstream patches are available in stable kernel branches.
Null pointer dereference in WebAssembly Binaryen up to version 125 allows local authenticated users to cause denial of service by manipulating the Index argument in IRBuilder::makeLocalGet, IRBuilder::makeLocalSet, or IRBuilder::makeLocalTee functions. Public exploit code exists, though real-world impact is minimal given the very low EPSS score (0.03%, 7th percentile) and local-access-only attack vector. This vulnerability is low-severity and unlikely to be prioritized for rapid patching in most environments.
Reachable assertion in Open5GS up to version 2.7.6 affects the PFCP context management functions (PDR, FAR, URR, QER) in lib/pfcp/context.c, allowing remote attackers to trigger a denial of service condition via crafted PFCP messages. The vulnerability requires high attack complexity and has low availability impact, but publicly available exploit code exists. CVSS 2.9 / EPSS 0.14% indicates low real-world exploitation probability despite public POC.
Null pointer dereference in Open5GS up to version 2.7.5 allows remote authenticated attackers to cause denial of service by sending manipulated PFCP (Packet Forwarding Control Protocol) packets that trigger improper handling in the FAR-ID handler component. The vulnerability requires high attack complexity and authenticated access, limiting real-world exploitation despite publicly available proof-of-concept code and a low CVSS score of 1.3 reflecting restricted impact scope.
Null pointer dereference in OFFIS DCMTK up to version 3.6.9 within the DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest functions in dcmqrscp causes denial of service. The vulnerability requires local access with low privilege level and results in availability impact through service crash. No public exploit code is confirmed, and EPSS exploitation probability is extremely low at 0.04%, indicating this is a low-priority reliability issue rather than an active security threat.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Safari and Apple operating systems contain a race condition that crashes the rendering process when processing maliciously crafted web content, affecting Safari 26.2 and earlier, iOS 18.7.3 and earlier, iPadOS 18.7.3 and earlier, macOS Tahoe 26.2 and earlier, tvOS 26.2 and earlier, visionOS 26.2 and earlier, and watchOS 26.2 and earlier. The vulnerability requires user interaction (clicking a malicious link or visiting a hostile website) and has high attack complexity, resulting in denial of service through process crash rather than data compromise. No public exploit code has been identified, EPSS exploitation probability is very low at 0.12%, and Apple has released patched versions across all affected platforms.
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in Ningyuanda TC155 firmware 57.0.2.0 via malformed RTSP requests to an unauthenticated RTSP service allows local network attackers to crash or degrade the device without authentication. Publicly available exploit code exists; the vendor did not respond to early disclosure notification. CVSS score of 2.1 reflects the low severity due to limited attack surface (local network only) and availability impact alone, but real-world risk depends on device deployment context and exposure to untrusted local networks.
Local denial of service in cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) 6.0.4 for Android: the plugin registers an exported broadcast receiver (nl.xservices.plugins.ShareChooserPendingIntent) that dereferences Intent.EXTRA_CHOSEN_COMPONENT without a null check, so any other app on the device can crash the host application by sending a crafted ACTION_SEND broadcast without that extra. The flaw requires no permissions and no user interaction, and is reachable only on affected Android builds, so the impact is limited to availability (repeated application-level crashes) rather than data loss or code execution. Exploit code and a public write-up exist, but there is no evidence of this being exploited in the wild beyond proof-of-concept demonstration, and no CISA KEV listing.
Unauthenticated denial-of-service in a Rockwell Automation controller allows remote attackers to trigger a hard fault by sending malformed CIP (Common Industrial Protocol) packets over the network, rendering the controller completely unresponsive. The device displays a solid red Fault LED and requires a physical power cycle followed by manual fault-code clearing (0xF019) before returning to operational state. Discovered during fuzzing, this vulnerability targets OT/ICS environments where controller availability is safety-critical; no active exploitation or public exploit code has been identified at time of analysis.
Rockwell Automation Micro850 and Micro870 programmable logic controllers enter a recoverable fault state (fault code 0xFE60) when their IPv6 stack processes multiple malformed packets from an adjacent network segment. The impact is purely an availability disruption requiring manual operator intervention to clear the fault - no confidentiality or integrity compromise occurs. This is particularly significant in OT/ICS environments where controller downtime can halt industrial processes, though the fault is described as recoverable rather than bricking the device.
Memory corruption in Apple operating systems due to insufficient bounds checking allows local authenticated users to cause denial of service through malicious data processing, affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability requires local access and user interaction, with no public exploit identified; EPSS score of 0.02% indicates minimal real-world exploitation probability despite the assigned CVSS score of 2.8.
Use-after-free memory corruption in Apple WebKit allows remote attackers to crash Safari and iOS/iPadOS applications via maliciously crafted web content, resulting in denial of service. The vulnerability affects Safari 26.2, iOS 18.7.2 and 26.2, iPadOS 18.7.2 and 26.2, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited; however, the network-accessible attack vector and low complexity make it a moderate priority despite the low EPSS score.
Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.
Denial-of-service vulnerability in Apple macOS allows local authenticated applications to crash the system or specific services through improper input validation. Affects macOS Sequoia (before 15.7.3), Sonoma (before 14.8.3), and Tahoe (before 26.2). Attack requires local access and low privileges but no user interaction; however, real-world risk is minimal with EPSS probability of 0.02% and no public exploit identified.
Memory corruption in macOS kernel allows authenticated local users to execute arbitrary code or crash the system. Apple fixed the vulnerability via improved memory handling in macOS Sequoia 15.7.4, Sonoma 14.8.4, and Tahoe 26.1. With CVSS 7.8 (High severity) reflecting local attack vector requiring low privileges, and EPSS at 0.01% (2nd percentile), this represents a moderate real-world risk despite high CVSS scoring. No public exploit identified at time of analysis, and no evidence of active exploitation (not in CISA KEV).
Use-after-free vulnerability in whisper.cpp up to version 1.8.2 affects the read_audio_data function in common-whisper.cpp, allowing local authenticated attackers to trigger memory corruption with limited confidentiality and integrity impact. The flaw requires local access and valid user privileges on the system, with publicly available exploit code currently circulating; however, the extremely low EPSS score (0.03%, 7th percentile) and minimal CVSS severity (1.9) suggest limited real-world exploitability despite public proof-of-concept availability.
Servify Express, a Node.js package for starting Express servers, contains a denial of service vulnerability caused by the absence of size limits on JSON request bodies parsed by express.json(). Attackers can exploit this by sending extremely large payloads to cause memory exhaustion and crash the application process. With an EPSS score of 0.07% (21st percentile), active exploitation remains low-probability, though a patch is available and the vulnerability affects any internet-facing application using affected versions.
Local code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a user opens a maliciously crafted .ctl project file, triggering a use-after-free condition (CWE-416) in the parser. The flaw was reported by ICS-CERT (DHS) and documented in CISA ICS advisory ICSA-25-345-03, but there is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.
Denial of service in the Bluetooth firmware of the JXL 9-inch Car Android Double Din Player (Android v12.0) lets an attacker within Bluetooth range crash the head unit by sending a malformed Link Manager Protocol (LMP) packet. The flaw sits in the low-level Bluetooth baseband/link layer, so no pairing or user interaction is needed to disrupt availability of the in-vehicle infotainment system. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%, 20th percentile), consistent with a niche automotive product rather than a mass-exploited target.
Cross-site request forgery in 1Panel (versions 1.10.33 through 2.0.15) lets a remote attacker change the TCP port the web management service listens on by luring an authenticated administrator to a malicious webpage. Because the port-change endpoint has no anti-CSRF token or Origin/Referer checks, the victim's browser silently replays valid session cookies, moving the panel off its expected port and causing loss of access, denial of service, or unintended exposure on an attacker-chosen port. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially craftable given the described missing defenses.
Account lockout denial-of-service in 1Panel (versions 1.10.33 through 2.0.15) allows a remote attacker to forcibly change an authenticated victim's username via a cross-site request forgery flaw in the Change Username endpoint at /settings/panel. Because the endpoint lacks anti-CSRF tokens and Origin/Referer validation, a victim who visits a malicious page while logged in unknowingly submits a username change with valid session cookies, after which they are logged out and locked out of their account. No public exploit identified at time of analysis; disclosed via a VulnCheck advisory with no CISA KEV listing and no EPSS data supplied.
Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVariant parser by supplying maliciously crafted serialized/text input, resulting in denial of service and potentially arbitrary code execution. Any application linking GLib that deserializes untrusted GVariant data is exposed, which spans broad swaths of the Linux desktop and system stack across Red Hat Enterprise Linux 7-10 and SUSE. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.26%, 49th percentile) despite the 9.8 CVSS, indicating the headline severity is not yet matched by observed exploitation interest.
Local code execution in Microsoft Office (365 Apps, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) stems from a use-after-free memory corruption flaw tracked as CVE-2025-62557. An attacker who entices a user to open a crafted document can achieve arbitrary code execution with the privileges of the current user, with no public exploit identified at time of analysis. The CVSS 8.4 rating reflects high impact across confidentiality, integrity, and availability despite the local attack vector.
OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.
A serialization bug in matrix-sdk-base allows remote attackers to cause denial-of-service by sending rooms with custom m.room.join_rules values, which stalls the sync process and prevents all room processing. The vulnerability affects matrix-sdk-base versions 0.14.1 and prior and has a high availability impact (CVSS 7.5) with a patch available in version 0.16.0. With a low EPSS score of 0.06% and no KEV listing, this represents a moderate real-world risk primarily concerning service availability rather than active exploitation.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.