Denial of Service

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.

Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.

Process-crashing race condition in the OpenTelemetry-Go OpenTracing bridge (`go.opentelemetry.io/otel/bridge/opentracing`) allows denial of service when concurrent goroutines access the same `bridgeSpan` - one writing baggage via `SetBaggageItem` and another reading it via `correlation.MapFromContext`. Because Go's runtime detects unsynchronized map access and terminates the process with a fatal panic, any application using the bridge with correlation hooks and concurrent span access is vulnerable to abrupt process termination. A proof-of-concept is publicly available; no confirmed active exploitation (KEV) has been reported.

Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack surfaces: authenticated users can trigger excessive resource consumption to degrade service availability, and the same pathway permits upload of non-official packages, introducing a package-integrity risk alongside the denial-of-service vector. Affected deployments running any release in the 2.0.0-2.3.x range should treat this as a priority upgrade given the dual nature of the flaw. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not designated template responsible persons to view template configurations they should not have access to. The CVE is tagged CWE-400 (Uncontrolled Resource Consumption) and classified as Denial of Service, yet the description describes an access control bypass - this is a data contradiction that analysts should flag before making control decisions. No public exploit or active exploitation has been identified. Vendor fix is available in Apache InLong 2.4.0.

ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.

Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.

Pcapng file parser crash in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18 enables denial of service via a locally-opened malformed capture file. Rooted in CWE-125 (Out-of-Bounds Read), the parser reads beyond an allocated buffer boundary when processing certain pcapng structures, causing application termination. No public exploit identified at time of analysis and not listed in CISA KEV; real-world risk is constrained by the local attack vector and required user interaction.

Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.

Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.

Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.

Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.

Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.

Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.

Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.

Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.

Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.

Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.

The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.

Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.

Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.

Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.

Splunk Connect for Kafka below version 2.2.7 contains an uncontrolled resource consumption flaw in its HTTP Event Collector retry mechanism, enabling an unauthenticated network attacker who can also manipulate HEC endpoint responses to trigger an infinite retry loop that permanently halts Kafka-to-Splunk event delivery. The vulnerability arises because the connector applies an unbounded default retry count for failed HEC batches rather than a finite limit, causing the connector to stall indefinitely when fed persistent failure responses. No active exploitation has been confirmed - the vulnerability is not in CISA KEV - and no public exploit code has been identified at time of analysis.

Search Head Cluster member control endpoints in Splunk Enterprise fail to enforce HTTP method-based authorization, allowing a user holding the high-privilege `list_search_head_clustering` capability to send read-typed HTTP requests that alter cluster state and cause a denial of service. Four release branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with fixed versions available from Splunk (SVD-2026-0801). No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; exploitation is constrained to authenticated insiders or post-compromise attackers holding a high-privilege Splunk role.

Server-Side Request Forgery in Splunk Enterprise and Splunk Secure Gateway allows low-privileged authenticated users to manipulate internal Splunk services via crafted report notification paths. Affected versions span Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.9, 3.9.23, and 3.8.70. An attacker holding any valid Splunk account - excluding admin and power roles - can leverage the unvalidated path handling in Secure Gateway to issue system-authenticated internal requests, potentially disrupting Search Head Cluster state or causing denial of service. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Authentication bypass in IBM System Storage DS8A00 (firmware 10.1.3.0-10.11.35.0) and DS8900F (firmware 89.40.83.0-89.44.25.0) exposes enterprise storage array management interfaces to network-reachable attackers who can circumvent security controls without valid credentials, enabling exfiltration of sensitive management data or availability disruption. The root cause is CWE-116 (Improper Encoding or Escaping of Output) in DSCLI command output processing, where encoding defects allow authentication logic to be bypassed. No public exploit code has been identified at time of analysis, and a vendor patch is available via IBM's security advisory.

Denial of service in IBM Reliable Scalable Cluster Technology (RSCT) 3.0 allows an unauthenticated attacker on an adjacent network segment to crash or disable cluster services by sending a specially crafted request. The root cause is improper input validation (CWE-770), which fails to bound resource consumption on malformed input, producing a full availability impact with no confidentiality or integrity exposure. No active exploitation has been identified and no public proof-of-concept is known at time of analysis.

Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing the RFC 8016 mobility extension (--mobility). The attacker repeatedly resumes a single TURN allocation from fresh UDP 5-tuples without completing handoffs, which overwrites the allocation's sole mobile_pending_resume backlink and orphans prior pending sessions whose cleanup watchdogs have been disarmed - causing unbounded process memory growth. No public exploit has been identified at time of analysis, though the patch commit includes a Python regression script (mobility_resume_flood.py) that precisely models the attack pattern, serving as an effective blueprint; exploitation requires both --mobility to be enabled and valid authenticated TURN credentials.

Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.

Memory exhaustion in BuildKit prior to v0.31.1 allows a denial-of-service condition against the buildkitd daemon when it processes a maliciously crafted base image. The daemon reads /etc/passwd and /etc/group from attacker-controlled images without any size limit during UID/GID resolution, enabling an oversized file to exhaust host memory and trigger an OOM kill of buildkitd. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 score of 2.3 reflects the constrained impact: availability-only, requiring user interaction with a hostile image.

Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.

Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.

Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.

Authenticated denial-of-service in IBM Virtualization Management Interface (VMI) allows an administrator-level attacker positioned on an adjacent network to trigger an integer overflow that crashes the VMI process. Affected firmware spans FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. While the VMI restarts automatically after a single crash, repeated exploitation can sustain a meaningful availability disruption; no public exploit or active exploitation has been identified at time of analysis.

Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.

Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.

Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.

Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated remote attacker to crash the web management interface by sending a crafted `ssid_number` parameter to the `ajaxSet_wireless_network_configuration.jst` AJAX handler. The flaw was reported by CERT/CC and documented by independent researchers at Wrocław University of Technology alongside multiple other RDK-B vulnerabilities. No public exploit has been identified and EPSS scoring (0.16%, 6th percentile) reflects very low real-world exploitation probability.

Process-terminating denial of service in Wekan's export API (versions prior to 10.38) allows an attacker to crash the entire server with a single crafted GET request. Four export handlers in models/export.js and models/exportExcel.js called user._id.toString() on the undefined result of ReactiveCache.getUser() without a null guard; supplying an invalid authToken query parameter to any export endpoint triggers a TypeError that propagates as an unhandled async rejection and terminates the Meteor/Node.js process, denying service to all concurrent users. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog, though the attack path is trivially reproducible given the explicit description and public commit diff.

Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.

Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.

Uprobe-based gadget attachment in Inspektor Gadget (versions >= 0.27.0, < 0.53.1) can be weaponized by any unprivileged container to cause approximately 53 seconds of CPU burn in the IG daemon by supplying a crafted `/etc/ld.so.cache` file - no container capabilities required. Because IG uses fanotify hooks to pause container startup until uprobe attachment completes, and Docker serializes container starts behind that pause, a single crafted container effectively blocks all other containers on the host from launching for the duration of processing. The attack is amplifiable by starting multiple crafted containers simultaneously, and no public exploit has been identified at time of analysis.

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Memory exhaustion in Wazuh's cluster protocol allows an authenticated cluster node to crash the master by sending unbounded allocation requests via the new_str command or the divided-message reassembly path. Affected deployments span versions 3.9.0 through 4.14.4 and 5.0.0-beta1, with the primary operational impact being disruption of agent connectivity and alert processing across the monitored environment. No public exploit has been identified at time of analysis; however, the published patch diff fully exposes both vulnerable code paths, lowering the barrier for future exploit development.

Management plane flood protection deficiency in Cisco Industrial Ethernet 1000 Series Switches enables unauthenticated remote attackers to exhaust CPU resources, rendering the device manager web GUI, SSH, and API inaccessible. All firmware branches from 1.1 through 1.9.5 are confirmed affected per EUVD-2026-62559. Critically, data-plane forwarding through the switch is explicitly unaffected - only management access is disrupted - though in OT/ICS environments this distinction matters less during incidents requiring remote intervention. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.

IBM PowerVM Hypervisor across firmware branches FW1060, FW1110, and FW1120 contains a format string vulnerability (CWE-134) that enables a local attacker with high-privilege access to extract sensitive hypervisor memory or trigger a denial-of-service condition crashing the hypervisor and all hosted virtual machines. The attack requires local presence, high privileges, and high attack complexity, confining realistic risk to insider threat or post-compromise scenarios. No public exploit code or active exploitation has been identified at time of analysis; IBM has confirmed a patch is available.

Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.

Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. A publicly available proof-of-concept has been confirmed via a GitHub issue report; no active exploitation has been recorded in CISA KEV at time of analysis.

The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog based on available data.

BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.

Denial-of-service in libheif 1.23.0 and earlier crashes host processes when a crafted HEIF sequence file - accepted by heif_context_read_from_memory() - leaves the context with no registered sequence tracks and heif_context_get_track() is subsequently called. Debug builds abort on assert(has_sequence()) in HeifContext::get_track(); release builds reach undefined behavior by dereferencing m_tracks.begin()->second on an empty std::map, which typically causes a segfault. The flaw is reachable through documented public APIs after parsing attacker-controlled bytes, making it directly relevant to any service that processes untrusted HEIF or AVIF input. No public exploit code is identified at time of analysis, and no CISA KEV listing exists.

Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.

Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).

Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.

Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.

Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.

Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to cause a complete denial of service - hang or repeatable crash - with a scope change that can impact additional products beyond VirtualBox itself, such as guest virtual machines sharing the same host. The vulnerability is locally-triggered and requires existing privileged access to the infrastructure, limiting opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.

Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.

Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.

Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.

MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.

Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.

Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.

Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.

Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.

Oracle Installed Base within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes its User Interface component to low-privileged authenticated attackers over HTTP, enabling unauthorized read access, data manipulation (insert, update, delete), and partial denial of service. Disclosed via Oracle's August 2026 Critical Patch Update, this vulnerability is easily exploitable with no attack complexity requirements once a valid low-privileged account is obtained. No public exploit code or CISA KEV listing is present at time of analysis, but the low access complexity and broad version range across 13 minor releases increases organizational exposure.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.

Local privilege-abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged local attacker to partially corrupt data integrity and cause a partial denial of service against the Installation and Configuration component. The vulnerability requires physical or logical logon access to the host infrastructure where Hyperion executes, and exploitation is rated High Complexity, significantly constraining real-world risk. No public exploit code and no CISA KEV listing are associated with this vulnerability at time of analysis.

Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.

Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.

SSH private key material in Blueprint Studio versions prior to 2.5.2 was temporarily written to disk under the Home Assistant configuration directory during terminal SSH authentication sessions, with permissions hardened only after the write and cleanup performed on a best-effort basis. Any user or co-located process with read access to the HA configuration directory could recover the residual key if cleanup was skipped due to a crash or exception. The fix in 2.5.2 eliminates the disk write entirely by switching to in-memory Paramiko sessions. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.

Remote denial-of-service in Zephyr RTOS's Precision Time Protocol stack (versions 3.7.0 through pre-4.4.2) allows any link-adjacent unauthenticated attacker to crash a CONFIG_PTP-enabled node by sending a crafted PTP frame carrying an undefined message type (0xE or 0xF). The 4-bit wire-type field is used without an upper-bound check to index a 14-entry msg_size[] array, and the out-of-range value is subsequently reused as a TLV parsing budget, driving further out-of-bounds reads and in-place byte-swap writes past the received message slab. No public exploit code or CISA KEV listing exists at time of analysis, but the crash path is described in the upstream advisory as reliably reproducible with no authentication required from the link layer.

Unprivileged user-mode threads in Zephyr RTOS (versions 2.3.0 through 4.4.1) can escape the userspace sandbox by exploiting an inverted boolean check in the syscall access-control handler, yielding two compiler-dependent outcomes: on Clang-compiled builds, a deterministic kernel crash via illegal-instruction trap reachable from any unprivileged thread; on GCC builds, undefined behavior that may suppress the return-value check and allow unauthorized abortion or joining of threads the caller was never granted access to. The CVSS vector (AV:L/PR:L/S:C/A:H) reflects the scope change from user-mode into supervisor context, and no public exploit has been identified at time of analysis - a vendor patch is available as of Zephyr 4.4.2.