Denial of Service

Null pointer dereference in OMEC Project AMF versions up to 2.1.3-dev allows remote authenticated attackers to trigger denial of service via crafted NGAP messages to the RANConfiguration function. The vulnerability (CVE-2026-8781) affects the Access and Mobility Management Function component of the Open Mobile Evolved Core, a critical element in 5G networks. Publicly available exploit code exists (GitHub issue #673), but CVSS 2.1 (Low) reflects limited availability impact and low-privilege authentication requirement. Vendor-released patch: version 2.2.0 (GitHub PR #666).

Denial of service in the tinyMQTT broker (commit 6226ade, 2024-02-18) lets remote unauthenticated clients exhaust server resources by repeatedly sending malformed CONNECT packets. When a CONNECT arrives with a zero-length Client ID and CleanSession=0, the broker sends the correct CONNACK 0x02 (Identifier Rejected) but never closes the TCP socket, leaking a file descriptor and memory on every attempt until the process is starved. Publicly available exploit code exists (a resource-exhaustion PoC is attached to the NVD reference), but there is no public exploit identified as used in attacks, EPSS is very low (0.05%), and it is not in CISA KEV.

Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers to consume excessive system resources via specially crafted requests to JSON response handlers. Public proof-of-concept exists. EPSS data not available. Not listed in CISA KEV. CVSS 4.0 score of 2.1 reflects low availability impact (VA:L) with authenticated network access (PR:L). Vendor non-responsive to initial disclosure.

Use-after-free vulnerability in Open5GS NRF component (versions up to 2.7.7) allows authenticated remote attackers to trigger denial of service via the discover_handler function in nghttp2-server.c. Publicly available exploit code exists (GitHub issue #4476), but vendor has not responded to early disclosure. EPSS data not available; CVSS 4.3 (Medium) reflects limited scope (DoS only, authenticated access required). Not listed in CISA KEV, indicating no confirmed widespread exploitation despite public POC.

Remote authenticated denial of service in Open5GS versions up to 2.7.7 allows attackers to crash the AUSF (Authentication Server Function) component via crafted timer manipulation. The vulnerability resides in ogs_timer_add function within nausf-handler.c. Public exploit code exists via GitHub issue #4472, though vendor has not responded to disclosure. EPSS data unavailable; CVSS 4.0 scores only 2.1 due to low availability impact and authenticated requirement, but the existence of public exploit elevates practical risk for exposed 5G core deployments.

Denial of service in Open5GS NRF (Network Repository Function) allows authenticated remote attackers to crash the service by exhausting the nf_service resource pool. Open5GS versions up to 2.7.7 fail to validate pool allocation during NF service registration, triggering assertion failures that terminate the process. Publicly available exploit code exists (GitHub issue #4466). EPSS data not available, not listed in CISA KEV. Patch released via commit 819db11a08b9736a3576c4f99ceb28f7eb99523a, merged in PR #4534.

Denial of service vulnerability in Open5GS NRF client management (versions ≤2.7.7) allows authenticated remote attackers to crash the Network Repository Function service via malformed client pool arguments. Public exploit code exists (GitHub issue #4464), but vendor has not responded to disclosure. CVSS base score of 4.3 reflects low severity due to limited availability impact and authentication requirement. EPSS data not provided; KEV status not applicable for this unpatched issue.

Denial of service in Open5GS versions up to 2.7.6 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via crafted nfInstanceId parameter manipulation in the ogs_sbi_nf_instance_set_id function. Publicly available exploit code exists (GitHub issue #4462), but vendor has not responded to early responsible disclosure. EPSS data not available, not listed in CISA KEV. CVSS 4.3 (Medium) reflects low impact (availability only) and authenticated attack vector.

Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component by manipulating service-names or snssais parameters in SBI messages. A public proof-of-concept exploit exists via GitHub issue #4460, and the vendor has not responded to the early disclosure. EPSS data unavailable, but the low CVSS 4.3 score reflects limited impact (availability only, authenticated access required), reducing real-world urgency for most deployments.

Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component via malformed target-plmn-list parameters. The vulnerability targets a parsing function in the Service-Based Interface (SBI) library and has publicly available exploit code (GitHub issue #4458). CVSS 4.3 reflects low severity, but the vendor has not responded to early disclosure attempts, leaving no confirmed patch timeline. EPSS and KEV data unavailable - exploitation likelihood beyond POC unknown.

The qs Node.js library (versions 6.11.1 through 6.15.1) crashes with a synchronous TypeError when stringify is called with both arrayFormat: 'comma' and encodeValuesOnly: true on arrays containing null or undefined elements. Applications using these non-default options together will experience request failures (typically 500 errors in web frameworks) when processing user input with null array values. The vulnerability was introduced in commit 4c4b23d (PR #463, January 2023) and patched in v6.15.2 (commit 21f80b3). No public exploit or CISA KEV listing identified at time of analysis, though exploitation requires only crafting JSON input with null array elements.

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessively long character strings. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessively long character strings. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Unauthenticated attackers can modify Smartcat API credentials in the Smartcat Translator for WPML plugin through a missing capability check on the 'routeData' REST endpoint, allowing hijacking of translation services or denial of service. All versions through 3.1.77 are affected. The vulnerability requires only network access and no user interaction, making it remotely exploitable by any unauthenticated actor against default WordPress configurations running the vulnerable plugin.

Improper isolation of GPU HW register space could allow a privileged attacker in malicious Guest Virtual Machine (VM) to perform unauthorized access to specific victim range of GPU MMIO register. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

DDR5 memory modules in multiple AMD Ryzen processor families contain an insecure default PMIC (Power Management Integrated Circuit) interface configuration that allows local users with standard privileges to cause permanent denial of service or corrupt memory module integrity via unprotected firmware access. The vulnerability affects Ryzen 4000, 7000, 7020, 7030, 7035, 7040, 7045 series processors and Threadripper Pro 3000 WX-series, requiring local system access but no special privileges or user interaction. No public exploit code or active exploitation has been confirmed at time of analysis.

Buffer overflow in AMD Sensor Fusion Hub Driver allows local authenticated attackers to write out of bounds, causing denial of service or system crash. The vulnerability affects multiple Ryzen processor families (4000, 5000, 7000, 7020, 7030, 7035, 7040 series and Ryzen AI 300 series) with Radeon integrated graphics across Windows mobile and desktop platforms. No active exploitation has been confirmed at time of analysis.

Arbitrary code execution and denial of service in AMD Platform Management Framework (PMF) affects Ryzen 7035, 7040, 8040 mobile processors and Ryzen Embedded 8000 series. A local authenticated attacker exploiting an unchecked return value vulnerability can write to arbitrary memory locations, potentially escalating privileges from low to high integrity across system boundaries. The CVSS 4.0 score of 7.1 reflects local attack vector with low complexity but requires specific attack timing conditions (AT:P), though the cross-scope impact (S:H) and high confidentiality/integrity impact to subsequent systems elevate real-world risk for enterprise environments with AMD mobile processors.

Buffer overflow in the AMD Secure Processor (ASP) PCI driver affects dozens of AMD Ryzen, EPYC, and Threadripper processor families across desktop, mobile, and embedded variants. Local attackers with user-level privileges can trigger improper input validation in the driver to cause a crash or denial of service, with potential for integrity impact. The vulnerability requires local access and authenticated user privileges; no active exploitation in the wild has been confirmed, and vendor-released patches are available.

Use-After-Free vulnerability in the AMD Secure Processor (ASP) PCI driver affects multiple Ryzen, Threadripper, EPYC, and Athlon processor families due to improper input validation. A local attacker with user-level privileges can trigger the UAF condition, resulting in denial of service via platform crash or potential loss of platform integrity. Vendor-released patch: AMD Ryzen Chipset Driver 7.02.13.148 (or equivalent Catalyst driver versions for embedded SKUs). No public exploit identified at time of analysis.

Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.

Unauthenticated email flooding via the forgot-password endpoint in Tuist affects self-hosted deployments prior to version 1.180.10. The password reset flow lacks server-side rate limiting (CWE-770), enabling any attacker with knowledge of a valid account email to programmatically trigger unlimited reset emails. No public exploit has been identified at time of analysis, and EPSS sits at just 0.05% (16th percentile), though SSVC flags the attack as automatable.

Regular expression denial of service (ReDoS) in Svelte 5.51.5 through 5.55.6 allows attackers to cause application hang or crash by passing unconstrained-length tag names to the `<svelte:element>` component, triggering exponential regex evaluation time in the runtime tag validation logic. The vulnerability requires applications to accept user-controlled tag input without length or content restrictions.

Cross-Site Request Forgery via image URL manipulation in Open WebUI allows authenticated users to perform unauthorized actions on behalf of victims by embedding malicious image URLs in profile pictures, model images, shared chats, and notes. When any user (including admins) views these compromised images, their browser sends GET requests to attacker-controlled servers, enabling cookie theft, denial of service, or execution of sensitive operations. Publicly available proof-of-concept code demonstrates exploitation across multiple attack vectors. The vulnerability affects all versions up to and including v0.9.2, with a vendor-released patch available in v0.9.3.

libsixel versions prior to 1.8.7-r2 crash on memory allocation failure in sixel_decode_raw and sixel_decode functions due to incorrect NULL pointer validation, allowing local attackers to trigger denial of service under low-memory conditions. The vulnerability affects any application using libsixel's public decoding APIs when system memory pressure causes malloc to fail.

Use-after-free in Chrome's GPU component prior to version 148.0.7778.168 enables an attacker who has already achieved renderer process compromise to perform out-of-bounds memory writes via a specially crafted HTML page. This is a second-stage exploit component embedded within a multi-step browser exploitation chain, requiring a pre-existing renderer foothold before the GPU flaw can be triggered. No active exploitation has been identified - CISA KEV is absent, EPSS probability stands at 0.03% (7th percentile), and SSVC rates exploitation as 'none' - and a vendor patch is confirmed available in Chrome 148.0.7778.168.

Use-after-free in the Google Lens component of Chrome prior to 148.0.7778.168 enables memory disclosure from a multi-stage attack chain requiring prior renderer compromise. An attacker who has already subverted the renderer process can leverage a crafted HTML page to trigger the UAF condition in Lens, reading potentially sensitive data from process memory. This is a chained exploitation scenario - not standalone remote code execution - and while CVSS scores PR:N, the renderer prerequisite substantially narrows real-world exploitability. No public exploit code or CISA KEV listing has been identified; EPSS probability sits at 0.03%.

Denial of service in Google Chrome's GPU process prior to 148.0.7778.168 allows a remote attacker who has already compromised the renderer process to crash the browser by passing malformed input through a crafted HTML page. This is a chained, post-exploitation DoS - not a standalone attack - requiring a prior renderer breach as an explicit prerequisite. No public exploit code has been identified, CISA KEV does not list this CVE, and EPSS sits at 0.06%, all consistently signaling low real-world priority.

Integer division by zero in GStreamer gst-plugins-good before version 1.28.2 allows local attackers to cause denial of service by supplying a maliciously crafted MP4 file with invalid atom data in audio tracks, triggering a crash in the qtdemux_audio_caps parser function without requiring user interaction or elevated privileges.

Integer division by zero in GStreamer gst-plugins-good before version 1.28.2 allows local attackers to cause denial of service by crafting malicious MP4 audio files. The isomp4 plugin's qtdemux_parse_trak function fails to validate atom data before performing division operations, causing application crash when parsing specially crafted audio tracks. No authentication required; exploitation requires only local file access and media playback.

Unbounded memory allocation and CPU exhaustion in OpenTelemetry Java SDK's baggage propagation allows remote unauthenticated attackers to degrade or deny service by sending oversized baggage headers. Affected components - W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator - all lacked enforcement of the W3C Baggage specification's recommended size and entry limits, causing character-by-character parsing of arbitrarily large inputs. A distinctive amplification risk exists: baggage is automatically re-injected into all outgoing requests, meaning a single malicious inbound payload can fan out DoS effects to downstream services that never directly received the original request. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Matrix Synapse homeserver versions prior to 1.152.1 allow authenticated local users to trigger CPU starvation that denies service to other users by exploiting unbounded lock timeout intervals in the WorkerLock implementation. Synapse deployments that do not trust all local users face service availability risk from malicious authenticated accounts. Vendor-released patch available in version 1.152.1 (GitHub commit 3f58bc50dfba5768ee43ce48c5e74c25ba0b078a confirms fix). No public exploit identified at time of analysis, though the attack mechanism is straightforward for any authenticated user.

GitLab CE and EE are vulnerable to authenticated denial of service through excessive memory consumption, affecting all installations from version 8.3 up to the patched releases. An authenticated user with minimal privileges can submit maliciously crafted input that bypasses proper validation, causing the server to allocate memory without adequate bounds until service degradation or outage occurs. EPSS is low at 0.06% (18th percentile), no active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and a vendor patch was released on May 13, 2026.

Denial-of-service in GitLab Enterprise Edition allows a crafted file upload to exhaust service availability through improper deserialization validation. The vulnerability spans an exceptionally wide range, affecting all GitLab EE instances from version 11.9 through the 18.11 line until patched releases. There is no public exploit identified at time of analysis and EPSS sits at 0.02% (4th percentile), indicating low observed exploitation pressure, though the breadth of the affected version range means unpatched installations represent a meaningful attack surface for availability disruption.

Denial of service in GitLab Community and Enterprise Editions (versions 18.5 through 18.11.2) allows remote unauthenticated attackers to exhaust resources by submitting specially crafted JSON payloads that bypass input validation. The flaw is network-reachable with low complexity and no authentication required, but only impacts availability (CVSS 7.5, A:H). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04% (11th percentile), though CISA SSVC flags the issue as automatable.

Denial of service in GitLab Community and Enterprise Edition versions 18.5 through 18.11.2 allows unauthenticated remote attackers to disrupt service availability by sending specially crafted payloads to certain API endpoints. The flaw maps to CWE-1284 (improper validation of specified quantity in input) and has been patched in 18.9.7, 18.10.6, and 18.11.3. No public exploit identified at time of analysis and EPSS probability is very low (0.03%, 9th percentile), but the SSVC framework flags the attack as automatable with partial technical impact.

Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.

Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (OOM) crash by exploiting the $__timeGroup macro against a configured SQL datasource. The attack is slow by nature - requiring upwards of 30 minutes to exhaust server memory - and affects Grafana OSS versions spanning from 8.0.0 through 13.0.1. Grafana reported this vulnerability directly, a vendor patch is available across all affected release branches, and no public exploit code or active exploitation has been identified at time of analysis.

Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to trigger an out-of-memory condition by sending a sufficiently large HTTP request body, resulting in denial of service against the Grafana instance. Affected versions span a wide range from 6.7.0 through 13.0.1, with vendor-released security patches available across all supported branches. No public exploit exists and CISA has not added this to the KEV catalog; the EPSS score of 0.04% (12th percentile) reflects very low observed exploitation probability.

Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory by submitting a large or streaming HTTP request body, resulting in an out-of-memory condition and denial of service. Confirmed affected branches span Grafana OSS 8.0.0 through 13.0.1 across five actively maintained release lines, with vendor-released security patches available for each. No public exploit code exists and CISA has not listed this in KEV; the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low current real-world exploitation activity.

Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sending concurrent requests triggers a fatal map access error that crashes the entire Grafana server, requiring a manual restart to restore service. All Grafana OSS releases from 8.2.0 through 13.0.1 are affected across multiple maintained branches, making the exposure surface exceptionally broad. No public exploit identified at time of analysis and EPSS sits at 0.04% (12th percentile), but the low privilege bar - any Viewer account - and reliable triggering (AC:L) mean insider threats and compromised low-privilege accounts represent a realistic DoS risk for organizations without guest/anonymous access controls.

Denial of service in Palo Alto Networks Prisma SD-WAN ION devices allows an unauthenticated attacker with adjacent network access to crash or disrupt the device by sending a specially crafted IPv6 packet. The vulnerability (CWE-606) exists across three active release branches of the ION software, with fixed versions available from Palo Alto Networks. No public exploit code exists and no active exploitation has been identified at time of analysis, with EPSS at 0.03% and SSVC confirming exploitation status as none.

Server-side request forgery in the IKEv2 implementation of Palo Alto Networks PAN-OS allows unauthenticated remote attackers to coerce the firewall into issuing outbound network requests to arbitrary destinations or to trigger a denial-of-service condition. Affected are PAN-OS 10.2, 11.1, 11.2, and 12.1 branch trains; Panorama, Cloud NGFW, and Prisma Access are explicitly confirmed unaffected. No public exploit code has been identified and SSVC assessment confirms no current exploitation, though a vendor-released patch is available across all impacted branches.

Multiple denial-of-service conditions in Palo Alto Networks PAN-OS allow unauthenticated remote attackers to crash or degrade firewall availability by sending specially crafted network traffic, with a high availability impact (VA:H) on the vulnerable system. Affected deployments span PAN-OS 10.2, 11.1, 11.2, and 12.1 branches as well as Prisma Access; vendor explicitly states Panorama and Cloud NGFW are not impacted, though Cloud NGFW appears in CPE strings - a discrepancy worth verifying. No public exploit identified at time of analysis, EPSS is very low (0.05%, 16th percentile), and SSVC classifies exploitation as none with non-automatable attack patterns, collectively suggesting a patch-cycle priority rather than an emergency response.

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the AP_InertialSensor_ADIS1647x.cpp,. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Disk exhaustion in AutoGPT Platform before version 0.6.32 enables denial of service through unbounded Docker container log accumulation under high user access volume. The platform writes execution activity to stdout/stderr without any rotation or size cap, and Docker captures these logs indefinitely to host disk - a CWE-770 resource allocation failure. No public exploit has been identified at time of analysis; SSVC confirms exploitation status of none, and EPSS is 0.01% (3rd percentile), indicating negligible observed exploitation probability.

Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_SmartAudio::loop,. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Nautobot's UI object bulk-rename endpoints (e.g., /dcim/interfaces/rename/) allow authenticated low-privilege users to trigger application-wide denial of service by submitting a maliciously crafted regular expression in the `find` field with the `use_regex` flag enabled, causing Python's re.sub() to enter catastrophic backtracking that stalls worker processes indefinitely. All Nautobot installations running versions prior to 2.4.33 (v2.x branch) or prior to 3.1.2 (v3.x branch, from 3.0.0a2) are affected. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS is 0.04% (14th percentile); vendor-released patches are available.

Unauthorized write access to Traefik's live dynamic configuration is achievable by a low-privileged Kubernetes tenant in shared Gateway deployments, because the Gateway API provider's `isInternalService()` check accepts any `TraefikService` name ending in `@internal` - not exclusively the intended `api@internal`. This allows a tenant with `HTTPRoute` creation rights to route external traffic to `rest@internal`, fully bypassing the `providers.rest.insecure=false` safeguard and gaining `PUT /api/providers/rest` write access. No active exploitation is confirmed (not in CISA KEV, EPSS at 0.01%), but a detailed proof-of-concept is published in the GHSA advisory and the SSVC framework marks the attack as automatable for tenants meeting the prerequisites.

Infinite fault loop in the Linux kernel's arm64 contiguous PTE (contpte) subsystem exposes systems using SMMU or CPU configurations without hardware dirty-bit management support to a local denial of service. The defect in `contpte_ptep_set_access_flags()` causes a gathered AF/dirty-bit view across contiguous sub-PTEs to produce false no-ops, leaving individual target sub-PTEs in a stale hardware state that triggers perpetual page faults on non-FEAT_HAFDBS-aware walkers such as SMMMUs without HTTU or CPUs with HA/HD disabled in CD.TCR. No confirmed active exploitation exists; EPSS is 0.02% at the 5th percentile, consistent with the hardware-specific, local-only attack surface.

Null pointer dereference in the Linux kernel's AMD ASoC ACP3x audio driver (acp3x-rt5682-max9836) allows a local low-privileged user on affected hardware to crash the kernel. The flaw originates in acp3x_5682_init(), which failed to validate the return value of clk_get() before passing it to rt5682_clk_enable(), meaning an error pointer could be dereferenced directly. No public exploit identified at time of analysis and the EPSS score of 0.02% (7th percentile) reflects extremely low exploitation interest; this vulnerability is not listed in the CISA KEV catalog.

NULL pointer dereference in the Linux kernel's RT1011 ASoC codec driver allows a local, low-privileged user to crash the kernel on systems equipped with Realtek RT1011 smart speaker amplifier hardware. The flaw in rt1011_recv_spk_mode_put() uses an incorrect helper to retrieve the DAPM (Dynamic Audio Power Management) context from a kcontrol object, yielding a NULL pointer that is subsequently dereferenced, triggering a kernel oops or panic. No public exploit is identified and EPSS of 0.02% (5th percentile) reflects negligible real-world exploitation probability, though vendor-confirmed patches are available in Linux 6.19.9 and 7.0.

Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.

Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_MSP::loop, AP_MSP, AP_MSP.cpp. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Integer underflow in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, with version 0.78.2 also cited) allows an attacker supplying crafted credential payloads to crash the application, producing a denial-of-service condition. The vendor advisory APSB26-53 confirms no user interaction is required for exploitation, though the local attack vector (AV:L) means the malicious payload must reach the SDK through a local processing channel. EPSS sits at 0.01% and CISA SSVC reports exploitation status as none, indicating no public exploit activity at time of analysis.

Integer overflow in Adobe CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application, producing a denial-of-service condition without requiring any user interaction. The flaw is classified under CWE-190 and carries a CVSS 6.2 score with local attack vector, meaning exploitation requires the attacker to be operating in the same local environment as the affected application. No active exploitation has been identified (SSVC: Exploitation: none), and EPSS places this at the 0th percentile, indicating near-zero observed exploitation probability.

Denial-of-service in Adobe CAI Content Credentials versions 0.7.0 and earlier (and additionally 0.78.2 per the CVE description) stems from improper input validation (CWE-20) that allows a local unprivileged attacker to crash the application without requiring user interaction. The vulnerability carries a CVSS 6.2 base score with local attack vector and high availability impact, but no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS exploitation probability is 0.01%, and CISA SSVC reports exploitation status as none - placing this squarely in routine patch cycle territory.

Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker without authentication to exhaust system resources, causing application-level denial of service. Rooted in CWE-400, the SDK imposes no sufficient limits on resource consumption when processing input, with the entire impact confined to availability - no confidentiality or integrity exposure exists. No public exploit code has been identified, EPSS sits at 0.01% (0th percentile), SSVC characterizes exploitation as 'none', and the vulnerability is absent from CISA's KEV catalog, collectively indicating low real-world exploitation probability at time of analysis.

Adobe CAI Content Credentials SDK versions 0.7.0 and earlier contain an improper input validation flaw that enables a local, unprivileged attacker to crash the application and cause a denial-of-service condition without any user interaction. The local attack vector (AV:L) confines exploitation to hosts where the SDK is installed and accepting input, which materially limits the threat surface despite the SSVC Automatable:yes classification. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) confirms near-zero empirical exploitation probability.

Integer overflow in Adobe's CAI Content Credentials SDK (versions ≤0.7.0 per EUVD; version 0.78.2 also cited in NVD description) enables a local, unprivileged attacker to crash the application by supplying crafted input, producing a denial-of-service condition with no confidentiality or integrity exposure. The root cause is a CWE-190 integer wraparound flaw confined entirely to availability impact. No active exploitation has been reported: EPSS sits at the 0th percentile, CISA SSVC rates exploitation status as 'none', and no public exploit code or CISA KEV listing exists at time of analysis.

Local denial-of-service in Adobe CAI Content Credentials SDK versions 0.7.0 and earlier (including 0.78.2) allows an attacker with local access to crash the application by supplying maliciously crafted input, triggering an improper input validation flaw (CWE-20). No user interaction is required to exploit the vulnerability, though exploitation is constrained to local attack vectors per the CVSS:3.1 AV:L designation. EPSS sits at 0.01% (1st percentile) and SSVC exploitation status is confirmed 'none', indicating no public exploit or active exploitation identified at time of analysis.

Uncontrolled resource consumption in Adobe CAI Content Credentials (versions 0.78.2, 0.7.0, and earlier) allows a local unprivileged attacker to exhaust system resources and crash the application. No user interaction is required, and the attack vector is local with no privilege prerequisites per the CVSS:3.1 vector. With an EPSS of 0.01% and SSVC exploitation status of none, this is currently a low-priority operational concern despite the high availability impact rating, though the SSVC automatable classification suggests the condition could be triggered programmatically once local access is available.

Integer underflow (CWE-191) in Adobe's CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application and cause a denial-of-service condition. No user interaction is required, and the SSVC assessment classifies the vulnerability as automatable, meaning reliable exploitation can be scripted. EPSS sits at 0.01% with SSVC exploitation status of 'none', and no active exploitation or public exploit code has been identified at time of analysis - real-world risk is correspondingly low despite the 'Automatable: yes' SSVC flag.

Improper input validation in Adobe's CAI Content Credentials SDK (versions 0.78.2 and 0.7.0 and earlier) allows a local attacker to crash the application by supplying malformed content credential data, resulting in a denial-of-service condition. The flaw requires no user interaction and no special privileges beyond local access to provide input to the application. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but SSVC flags exploitation as automatable once access is achieved.

Denial-of-service via improper input validation in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application without requiring any privileges or user interaction. The root cause is CWE-20 (Improper Input Validation), meaning the SDK fails to adequately reject or sanitize malformed input before processing it. No active exploitation has been identified (SSVC: Exploitation none; EPSS: 0.01%), and impact is limited strictly to availability - there is no confidentiality or integrity exposure.

Improper input validation in Adobe CAI Content Credentials (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application, producing a denial-of-service condition without requiring user interaction. The vulnerability stems from insufficient validation of attacker-supplied input processed by the SDK, classified under CWE-20. With an EPSS of 0.01% (1st percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low, though SSVC notes the attack is automatable once local access is achieved.

Uncontrolled resource consumption in Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and earlier allows a local attacker without credentials to exhaust system resources and crash the application. The vulnerability (CWE-400) is limited to a denial-of-service impact with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the SSVC also rates the issue as automatable, suggesting that once triggered, the resource exhaustion path requires minimal attacker effort.

Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.

Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Versions 5.0.1252.0 through 6.0.1698.0 (exclusive) are affected, with the flaw residing in the GetAllPaths function, which recurses into subdirectories without any depth ceiling or cycle-detection for inode loops. The impact is limited to a denial-of-service crash of the NanaZip process; no code execution or data exposure is possible. No public exploit and no active exploitation have been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) corroborates the low likelihood of real-world weaponization.

Memory exhaustion in NanaZip's littlefs filesystem image parser (versions 5.0.1252.0 through before 6.0.1698.0) allows a local denial-of-service condition when a victim opens a specially crafted archive. The parser's Open method blindly trusts the attacker-controlled BlockCount superblock field, and a 44-byte littlefs image with BlockCount set to 0xFFFFFFFF triggers approximately 4 billion heap allocations, exhausting available memory. No public exploit code URL is provided, though SSVC classifies exploitation status as proof-of-concept; the vulnerability is not listed in CISA KEV, and EPSS at 0.01% (2nd percentile) confirms minimal observed exploitation activity.

Integer divide-by-zero in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 5.x fail to validate the superblock field fs_ipg before using it as a divisor; setting it to zero in a crafted image triggers an immediate hardware trap and process termination. No public exploit has been identified and EPSS probability sits at 0.01% (2nd percentile), indicating negligible real-world exploitation risk at time of analysis.

NanaZip's UFS/UFS2 filesystem image parser crashes with a null-pointer dereference when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 6.0.1697.x fail to validate the type of the root inode before treating it as a directory: when inode 2 is typed IFLNK with a small di_size, the directory data buffer is allocated as zero-length and immediately dereferenced, crashing the application. No active exploitation has been identified (EPSS 0.01%, SSVC exploitation: none), and impact is limited to denial of service against the local NanaZip process.

Stack exhaustion in NanaZip's Electron Archive (ASAR) parser crashes the application when a user opens a specially crafted .asar file containing deeply nested JSON in the archive header. Versions 5.0.1252.0 through 6.0.1695.x are affected on Windows; exploitation requires local user interaction with no privilege escalation or code execution path. No public exploit exists and EPSS sits at 0.01% (2nd percentile), consistent with SSVC's 'Exploitation: none' signal - this is a low-priority denial-of-service fixed in the vendor-released 6.0.1698.0.

Adobe Illustrator versions 29.8.6, 30.3 and earlier are vulnerable to a NULL Pointer Dereference (CWE-476) in file parsing that crashes the application, resulting in a denial-of-service condition. Exploitation requires a victim to open a specially crafted malicious file, making this a file-borne, local-vector threat with no code execution capability. No public exploit code exists and EPSS places exploitation probability at 0.01% (3rd percentile), consistent with the SSVC assessment of no active exploitation and non-automatable delivery.

Unauthenticated deletion of arbitrary memory records in mem0 1.0.0 allows remote attackers to remove any database entry without credentials, causing unauthorized data loss and potential denial of service. The DELETE /memories/{memory_id} endpoint completely lacks authentication and authorization controls, exposing all memory records to deletion by any network-accessible attacker. No public exploit code has been identified, but the vulnerability is trivial to exploit given the straightforward API design.

mem0 1.0.0 server allows unauthenticated remote attackers to trigger memory reset and table re-creation via unprotected DELETE /memories endpoint, causing schema disruption, data loss, and denial of service. The vulnerability exploits missing authentication and authorization controls on a database management operation accessible over the network without credentials.

Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.

Null pointer dereference in Windows Storport Miniport Driver allows remote attackers to trigger denial of service over a network with user interaction. The vulnerability affects Windows Server 2025 and exists in the storage port driver architecture, requiring the attacker to send a specially crafted network request that causes the driver to dereference a null pointer, resulting in service interruption or system instability. No public exploit code or active exploitation has been confirmed.

Denial-of-service attacks against Fortinet FortiAnalyzer and FortiManager 6.4 through 7.6.4 allow authenticated attackers to trigger system hangs via specially crafted HTTP requests that exploit a use of potentially dangerous function vulnerability (CWE-676). The crash occurs only when internal lock alignment conditions are met, making exploitation dependent on timing and system state rather than attacker control. CVSS 5.2 reflects medium severity with high attack complexity and low availability impact; active exploitation is not confirmed.

Improper buffer restrictions in Intel's Display Virtualization for Windows OS driver software (Ring 2 device driver layer) allow a locally authenticated low-privileged user to trigger a denial of service condition affecting system availability. The flaw, tracked as CWE-119, resides in the driver's memory boundary enforcement and can be exploited without special internal knowledge or user interaction. No active exploitation has been identified (EPSS 0.01%, 3rd percentile; SSVC exploitation status: none), and the impact is limited to availability - confidentiality and integrity are unaffected.

Use-after-free in the Linux kernel ice driver for Intel Ethernet 800 series adapters before version 2.3.14 enables a local authenticated attacker with low privileges to trigger a kernel-level denial of service. The flaw resides in Ring 0 (kernel space), meaning heap corruption in the driver can cause kernel panics or system hangs with high availability impact to both the vulnerable system and subsequent dependent systems. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.01% (3rd percentile) reflects negligible near-term weaponization probability.

Null pointer dereference in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6.0 enables denial of service by local authenticated users operating within Ring 3 (user-space). The flaw requires low complexity and no user interaction, allowing a low-privileged local adversary to crash the affected driver component, producing availability loss with no confidentiality or integrity impact. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.01% (3rd percentile), indicating negligible real-world exploitation activity at time of analysis.

Denial of service in Intel Quick Assist Technology (QAT) software drivers for Windows before version 2.6 can be triggered by a low-privileged local user through improper input validation at the Ring 3 (user application) boundary. An authenticated but unprivileged local attacker can cause high availability impact to the affected system with low complexity, also producing minor confidentiality and integrity side effects. No public exploit code has been identified at time of analysis, and SSVC assessment classifies exploitation as none with non-automatable attack surface.

Divide-by-zero in Intel Quick Assist Technology (QAT) software drivers for Windows before version 1.13 allows a low-privileged authenticated local user to cause a denial of service. The flaw resides in the Ring 3 (user application) layer of the driver stack, meaning no kernel-level access or elevated privileges are required to trigger the crash. No active exploitation has been identified - EPSS is 0.01% at the 3rd percentile, the vulnerability is absent from the CISA KEV catalog, and SSVC rates exploitation as 'none' with automatable set to 'no.'

Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 contain an unchecked return value flaw in Ring 3 user-space application code, enabling a local authenticated attacker to cause a denial of service. The vulnerability carries a CVSS 4.0 score of 4.8 with strictly local access and low-privilege requirements, limiting blast radius to availability of the affected system only. No public exploit code exists and CISA has not listed this in KEV; EPSS at the 3rd percentile and SSVC exploitation status of 'none' confirm this is currently theoretical rather than actively targeted.