Denial of Service

Heap use-after-free in open62541's GDS PushManagement certificate update workflow enables remote unauthenticated denial of service against OPC UA servers built with the UA_ENABLE_GDS_PUSHMANAGEMENT compile-time flag. The vulnerability is remotely exploitable with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N per CVSS), crashing the affected server process. SSVC intelligence confirms a proof-of-concept exists and the attack is automatable, though EPSS at 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains limited or targeted as of time of analysis.

Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows remote unauthenticated attackers to crash OPC UA servers by sending crafted subscription-lifecycle requests. The affected request types - CreateSubscription, CreateMonitoredItems (Sampling mode), Publish, TransferSubscriptions, and DeleteSubscriptions - are core to OPC UA data exchange, meaning the vulnerability sits on a heavily-used protocol surface in industrial and IoT deployments. A POC exists per SSVC classification, the attack is rated automatable, and availability impact is rated High by NVD; however, EPSS stands at only 0.25% (16th percentile), indicating limited observed exploitation interest at this time.

Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.

Remote code execution via use-after-free in Microsoft Excel affects multiple product lines including Microsoft 365 Apps for Enterprise, Excel 2016, and Office 2019/LTSC 2021/LTSC 2024. An unauthenticated remote attacker can exploit this memory corruption flaw by convincing a target user to open a specially crafted Excel workbook, resulting in arbitrary code execution under the context of the victim process. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, no-privilege network attack vector makes it an attractive phishing payload candidate.

Remote code execution in Microsoft Edge (Chromium-based) is possible via a use-after-free memory corruption flaw exploitable over a network by an unauthenticated attacker who can induce user interaction with malicious content. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full impact potential against confidentiality, integrity, and availability, tempered by high attack complexity and mandatory user interaction. No public exploit identified at time of analysis and the temporal metric E:U (Unproven) aligns with this; a vendor-released patch is confirmed available via the Microsoft Security Response Center.

Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based `build_chain_inner` function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.

Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.

Out-of-bounds heap read in aiohttp's C HTTP response parser (versions ≤ 3.14.2) allows an attacker-controlled server to crash the client application via a malformed chunked HTTP response, causing denial of service. The flaw exists only when the compiled C extension is active - the default installation mode - and is triggered during error-message construction in aiohttp/_http_parser.pyx when the llhttp error-position pointer is materialized as a raw pointer rather than a bounded offset into the Python bytes buffer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9) allows unauthenticated attackers to either crash the Node.js process via an uncatchable out-of-memory error with a ~25 KB crafted input, or stall the event loop for over two minutes with a ~400 KB padded-sequence input. Both attack paths bypass the incomplete mitigation introduced in version 5.0.8 for CVE-2026-14257, meaning applications that already patched that predecessor vulnerability remain fully exposed. Publicly available proof-of-concept code is included in the GitHub security advisory; no CISA KEV listing is present at time of analysis.

Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. Rated CVSS 9.1 (network, no authentication, no user interaction); no public exploit identified at time of analysis, though the vendor's fix ships a regression test that reproduces the technique.

Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.

Remote denial of service in the Unisoc UDX710 modem allows a network-adjacent or remote attacker to crash the modem subsystem of affected devices by sending malformed or crafted input that bypasses input validation. The vulnerability requires no authentication and no user interaction, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is limited to availability - there is no confidentiality or integrity exposure - but a successful attack would disrupt cellular connectivity on the affected device. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Remote denial of service in the Unisoc UDX710 modem allows unauthenticated remote attackers to crash or disable modem functionality by sending crafted network input that bypasses input validation in the baseband stack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated privileges - only network-reachable access to the modem. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Remote denial of service in Unisoc T8100/T9100/T8200/T8300 modem firmware allows unauthenticated remote attackers to crash or render the modem inoperable through crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitation requires no authentication, no user interaction, and low complexity, making any exposed device potentially reachable. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low barrier to exploitation warrants prompt firmware patching.

Remote denial of service in the modem firmware of Unisoc T8100, T9100, T8200, and T8300 chipsets allows an unauthenticated remote attacker to crash the modem subsystem by sending crafted cellular signaling data, disabling cellular connectivity on affected devices. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects full availability impact with no victim-side prerequisites, though practical exploitation requires the attacker to control or simulate cellular network infrastructure in radio proximity. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Remote denial of service in Unisoc modem firmware affects T8100, T9100, T8200, and T8300 chipsets due to improper input validation in the modem stack. Unauthenticated remote attackers can crash or render the modem unresponsive - severing cellular connectivity on affected devices - without requiring any privileges or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-complexity attack path represents a meaningful availability risk for devices dependent on continuous cellular communication.

Remote denial of service in the Unisoc modem component of T8100, T9100, T8200, and T8300 chipsets allows unauthenticated network-adjacent or remote attackers to crash the modem by sending malformed input, severing cellular connectivity on affected devices. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms no privileges or user interaction are required, and the attack surface is the baseband network interface. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remote denial of service in Unisoc modem firmware affects T8100, T9100, T8200, and T8300 chipsets through improper input validation. An unauthenticated remote attacker can send crafted network input to the modem component, causing an availability failure - effectively cutting off cellular connectivity on affected devices. No public exploit has been identified at time of analysis, and no KEV listing exists, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N profile means no preconditions limit the attacker's reach against any device using these chipsets.

Improper input validation in Unisoc's NR (5G New Radio) modem component affects T8100, T9100, T8200, and T8300 chipsets, enabling remote denial-of-service against devices incorporating these baseband processors. The modem's failure to validate incoming data can be triggered remotely, causing an availability impact classified as High - effectively crashing or disrupting the modem subsystem. No public exploit code has been identified at time of analysis, and the vulnerability was disclosed by Unisoc via their product security bulletin.

Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place.

Uncontrolled resource consumption in NASA's fprime framework v4.2.2 exposes the Ref::SignalGen component to remote denial-of-service attacks via unsanitized user-supplied parameters. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated, low-complexity network exploitation - however, this risk must be contextualized: fprime is a niche aerospace embedded software framework, and a POC exists per SSVC data, though EPSS of 0.14% (4th percentile) signals negligible real-world exploitation interest. No public exploit has been confirmed as actively exploited, and the vulnerability is not listed in the CISA KEV catalog.

Integer overflow in the Svc::FileDownlink::SendPartial component of NASA's fprime embedded flight software framework v4.2.2 allows unauthenticated remote attackers to crash the service via crafted input, resulting in a Denial of Service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special privileges are required, and a potential proof-of-concept is referenced at a public GitHub issue tracker. Despite the high CVSS score, EPSS sits at just 0.14% (4th percentile), and there is no CISA KEV listing, reflecting the niche aerospace deployment context of this framework.

Denial of service in NASA Core Flight System (cFS) v7.0.1 results from insufficient replay protection in the CFDP (CCSDS File Delivery Protocol) receive path, enabling unauthenticated network attackers to crash or disrupt the flight software stack by sending replayed final CFDP PDUs. SSVC classifies this as automatable with a proof-of-concept available, though the EPSS score of 0.14% (4th percentile) reflects the narrow operational footprint of aerospace flight software. No CISA KEV listing confirms active exploitation at time of analysis.

Remote denial of service in NASA Core Flight System (cFS) v7.0.1 allows unauthenticated network attackers to crash the Software Bus Network (SBN) application by sending a crafted peer subscription packet that triggers a parser boundary flaw. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector confirms no authentication or user interaction is required, making this trivially reachable against any exposed SBN interface. Despite the high CVSS score of 7.5, the EPSS score of 0.16% at the 5th percentile and absence of a CISA KEV listing or public exploit code suggest no public exploitation activity at time of analysis.

Denial of Service in NASA core Flight System (cFS) v7.0.1 is achievable by any network-adjacent attacker who can reach the SBN UDP interface, requiring no authentication or special privileges. Sending a single crafted SBN frame is sufficient to trigger the fault, consistent with CWE-20 (Improper Input Validation) in the Software Bus Network application's UDP packet handler. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.14% (4th percentile), reflecting the niche aerospace deployment footprint rather than low technical severity.

Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.

Integer overflow in FreeRDP's audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends affects all versions before 3.29.0, exploitable by a malicious or compromised RDP server. The server can supply a crafted FramesPerPacket value that causes allocation size wraparound, leading to a heap-based buffer overflow on Linux/ALSA - potentially enabling code execution - or denial of service on all supported platforms. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; vendor-released patch (3.29.0) is available.

Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.

Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.

Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.

Denial of service in FreeRDP before 3.29.0 allows any unauthenticated network-reachable RDP client to exhaust server memory by sending a crafted RDPEI PDU with a large declared body length and no corresponding body data. The RDPEI server channel handler allocates a stream buffer sized to the attacker-controlled length field without first validating it against any maximum, making exploitation trivially repeatable. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the unauthenticated pre-auth vector (CVSS 4.0 PR:N, AV:N, AC:L) and 8.7 score indicate meaningful priority for deployments running FreeRDP in server mode.

Null pointer dereference in FreeRDP's smartcard virtual channel allows remote unauthenticated attackers to crash the process by sending malformed smartcard IRP (I/O Request Packet) requests. All FreeRDP releases before 3.29.0 are affected: crafting an IRP with a non-zero cReaders field but truncated reader-state payload causes the decoder to fail, after which the free_reader_states cleanup function dereferences a null pointer and terminates the session. Impact is limited to denial of service - no confidentiality or integrity compromise is possible. No public exploit code or CISA KEV listing identified at time of analysis.

Memory exhaustion in FreeRDP before 3.29.0 allows unauthenticated attackers controlling a malicious RD Gateway endpoint to crash the client by sending Transfer-Encoding: chunked HTTP response bodies of unbounded size. The `http_response_recv_body()` function fails to enforce the configured `RESPONSE_SIZE_LIMIT` exclusively for chunked responses, creating an exploitable gap in the intended safety boundary. No active exploitation (CISA KEV) or public POC has been identified, but the CVSS 4.0 score of 8.7 reflects the low attack complexity once an attacker can serve a malicious gateway response.

Remote denial of service in Thumbor (pip/thumbor <= 7.7.7) is triggered by passing an unbounded value to the built-in `filters:proportion()` image filter, causing the server to allocate extreme CPU and memory resources during resize operations. The filter executes in the POST_TRANSFORM phase - after request-level MAX_WIDTH/MAX_HEIGHT clamping has already run - making those server-side size guards ineffective as a compensating control. Publicly available exploit code (PoC) exists per the GitHub Security Advisory GHSA-phj3-59pf-cp83; the vulnerability is not currently listed in the CISA KEV catalog.

Denial of service in Thumbor's convolution image filter allows unauthenticated remote attackers to exhaust server processing capacity by submitting a crafted URL. Versions 7.7.7 and earlier contain a regular expression in the convolution filter parser whose subpattern `(A;)*A` causes Python's `re` module to exhibit exponential-time backtracking when the input is malformed (e.g., missing the required trailing column count). A public proof-of-concept is included in the GitHub Security Advisory, and no special configuration is required to trigger the flaw against a default Thumbor deployment. No CISA KEV listing exists at time of analysis, but the trivial exploitation path and public PoC make this a real priority for network-exposed instances.

Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.

Prototype pollution in @phun-ky/defaults-deep prior to version 2.0.5 allows remote unauthenticated attackers to write arbitrary properties to Object.prototype by supplying crafted objects containing keys such as __proto__, constructor, or prototype to the defaultsDeep() function. The root cause is that the library performed recursive object merging without filtering these special property names, enabling full process-wide prototype chain manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and exploitation is straightforward wherever untrusted input reaches the affected function.

Quadratic ReDoS in NLTK ReviewsCorpusReader allows an unauthenticated attacker to hang any application that processes untrusted reviews corpora, by supplying a single crafted line of approximately 100,000 bracket-less words. All NLTK versions through 3.9.4 are affected; the calls reviews(), features(), and sents() are all vulnerable entry points. Publicly available exploit code (PoC) is included in the advisory; no confirmed active exploitation in CISA KEV at time of analysis.

Server crash in LightFTP 2.3.1 is remotely triggerable by unauthenticated attackers exploiting a TOCTOU race condition in the ABRT cleanup path, enabling denial-of-service without credentials. The flaw arises because WorkerThreadId is re-checked outside the MTLock mutex between worker_thread_cleanup() and pthread_join(), allowing a racing new connection to cause pthread_join() to operate on an invalid thread ID. No active exploitation is confirmed (not in CISA KEV), though a related case study for CVE-2024-11144 - a prior incomplete fix of this same flaw - exists in the zeroscience/tuktam repository.

IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.

Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.

Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.

Remote unauthenticated denial of service in MZ Automation's libiec61850 (all versions before 1.6.2) allows an attacker to crash IEC 61850/MMS server processes by opening a crafted TCP/102 connection. The flaw sits in the ISO Presentation layer's normal-mode negotiation, where a missing length check on an attacker-controlled zero-length field triggers a bounded heap out-of-bounds read that terminates the process before any MMS session is even established. No public exploit identified at time of analysis and it is not on CISA KEV, but the pre-authentication network reach and low complexity make it a credible availability threat to exposed OT/ICS devices.

Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data.

Unsigned integer underflow in open62541's PubSub signature verification path enables an unauthenticated remote attacker to crash an OPC UA server with a single crafted UDP packet. Affected across versions 1.3.0-1.3.18, 1.4.0-1.4.17, and 1.5.0-1.5.5 on Windows and Linux, exploitation requires a non-default build with PubSub encryption enabled and a ReaderGroup in SIGN or SIGNANDENCRYPT mode - but demands no session, credentials, or prior authentication. Patches were released 2026-07-27 and CISA published ICS advisory ICSA-26-211-08 on 2026-07-30; proof-of-concept code is withheld at o6 Automation's request and no KEV listing is present, meaning active exploitation is not confirmed at time of analysis.

Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.

Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.

Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.

Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.

Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.

CPU exhaustion in the Perl module Date::Manip through version 6.99 allows unauthenticated remote attackers to cause unbounded denial of service by supplying strings containing long whitespace runs to any of the three exposed parsing entry points. The flaw is quadratic backtracking (CWE-1333) in the unanchored substitution within _parse_time: no time value is needed in the input, only a large block of whitespace, making it trivially deliverable via any user-controlled field that reaches the parser. SSVC rates this automatable with no confirmed active exploitation and EPSS sits at 0.19%, but any Internet-facing application that passes unsanitised date strings to Date::Manip is a viable DoS target.

Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).

Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory disclosure and denial-of-service in ASUSTOR ADM (the NAS operating system) arises from an externally-controlled format string in the Notification OAuth settings, where administrator-supplied notification configuration values are passed into an unsafe format function. An authenticated administrator can submit crafted format specifiers to leak process memory or crash the affected notification component, affecting ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by ASUSTOR's own security team.

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) arise from an unsafe format string operation in the Rsync Backup component, where user-controlled backup configuration or log data reaches a format function without a fixed format specifier. An authenticated attacker on the NAS management interface can leak process memory contents or crash the backup component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) allow an authenticated attacker to abuse a format string flaw in the Internal Backup component. Because user-controlled task input is echoed into an error response and passed to an unsafe format string operation, the attacker can leak process memory or crash the handling CGI process. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) allow an authenticated attacker to abuse the FTP Backup feature, whose user-controlled backup configuration data is written to a task log and later processed through an unsafe format string operation. Exploitation leaks CGI process memory or crashes the affected CGI process. No public exploit identified at time of analysis and the issue is not on the CISA KEV list; low-privilege authentication is required per the CVSS vector.

Memory-corruption remote code execution in Google Chrome's Dawn WebGPU graphics component affects all Desktop builds prior to 151.0.7922.72, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code - though confined inside the renderer sandbox, which is why Chromium rated it Low despite the CVSS 8.8. Exploitation requires only that a victim load a malicious page (UI:R), with no authentication. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Remote code execution in Google Chrome's PDFium component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code - confined to the renderer sandbox - when a victim opens a maliciously crafted PDF. The flaw is a CWE-416 use-after-free reported by Google's own Chrome team and fixed in the July 2026 Stable channel update; Chromium rated its intrinsic severity Low because execution is contained within the sandbox, though NVD's CVSS scores it 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.

Sandbox escape in Google Chrome's WebSockets implementation (versions prior to 151.0.7922.72) allows a remote attacker to potentially break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 9.6 due to a scope-changing sandbox escape, though Google's own Chromium severity rating is only Low and EPSS exploitation probability is minimal (0.17%). No public exploit has been identified and CISA SSVC lists exploitation status as none.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox by triggering a use-after-free in the browser's DNS handling via a crafted HTML page. Chromium rated the issue Low severity, and while the NVD CVSS is 9.6, SSVC records no observed exploitation and it is not automatable; there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is low at 0.17% (7th percentile), consistent with a second-stage chaining bug rather than a mass-exploited entry point.

Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine affects all desktop versions prior to 151.0.7922.72, triggered when a victim installs a crafted malicious Chrome extension that exploits a use-after-free memory-corruption bug. Google fixed this in the July 2026 Stable channel update, and no public exploit identified at time of analysis; EPSS is low at 0.13% (3rd percentile), consistent with Chromium's own 'Low' security-severity rating despite the CVSS base score of 8.8.

Remote code execution in Google Chrome's Sync component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a CWE-416 use-after-free reported internally by the Chrome team; it carries a CVSS 8.8 but Chromium rated the security severity as Low, and code execution is confined to the sandbox rather than the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.21% (12th percentile).

Sandboxed arbitrary code execution in Google Chrome's DevTools component affects all desktop builds prior to 151.0.7922.72, where a use-after-free (CWE-416) can be triggered by a crafted Chrome Extension. An attacker must first convince the victim to install a malicious extension, after which they can run code confined to the browser sandbox. Chromium rated this Low severity; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.13%, 3rd percentile).

Sandboxed remote code execution in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Medium by Chromium; no public exploit has been identified and EPSS estimates only a 0.27% exploitation probability, indicating low near-term likelihood despite the high CVSS base score. Critically, code execution is confined to the sandbox and does not by itself constitute a full host compromise.

Heap corruption in Google Chrome's Views UI framework on Linux affects all versions prior to 151.0.7922.72, where a remote attacker can leverage a use-after-free by luring a victim to a crafted HTML page. Because exploitation requires the user to visit malicious content (UI:R), it is not fully automatable, and there is no public exploit identified at time of analysis; EPSS estimates only a 0.18% exploitation probability (8th percentile) and SSVC records exploitation status as none. Chromium rated the underlying issue Medium severity, though the CVSS base score is 8.8 due to high confidentiality, integrity, and availability impact if successfully exploited.

Heap corruption in the TabStrip component of Google Chrome desktop before 151.0.7922.72 allows a remote attacker to trigger a use-after-free (CWE-416) when a user is lured to a crafted HTML page and performs specific UI gestures. Successful exploitation could lead to arbitrary code execution within the renderer process, though Chromium rates the severity as Medium and there is no public exploit identified at time of analysis. EPSS is low at 0.22% (12th percentile) and CISA SSVC records exploitation status as none.

Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.

Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.

Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.

Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.

Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.

Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.

Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).

Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.

Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.

Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.

Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).

Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.

Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.