Total
938 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-4321 | 2026-10-07 | N/A | N/A | ||
| In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation | |||||
| CVE-2025-59029 | 1 Powerdns | 1 Recursor | 2026-10-07 | N/A | 5.3 MEDIUM |
| An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY. | |||||
| CVE-2025-48704 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 7.5 HIGH |
| Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service. | |||||
| CVE-2025-49088 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 5.9 MEDIUM |
| Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service. | |||||
| CVE-2025-66379 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 7.5 HIGH |
| Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted media stream, resulting in a denial of service. | |||||
| CVE-2025-32096 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 7.5 HIGH |
| Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a denial of service. | |||||
| CVE-2025-32095 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 7.5 HIGH |
| Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling message, resulting in a denial of service. | |||||
| CVE-2025-66443 | 1 Pexip | 1 Pexip Infinity | 2026-10-07 | N/A | 7.5 HIGH |
| Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service. | |||||
| CVE-2025-20762 | 1 Mediatek | 16 Mt6835, Mt6835t, Mt6878 and 13 more | 2026-10-07 | N/A | 6.5 MEDIUM |
| In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01685181; Issue ID: MSV-4760. | |||||
| CVE-2025-20760 | 1 Mediatek | 51 Mt2735, Mt2737, Mt6833 and 48 more | 2026-10-07 | N/A | 6.5 MEDIUM |
| In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01676750; Issue ID: MSV-4653. | |||||
| CVE-2026-103099 | 1 Pexip | 1 Pexip Infinity | 2026-10-06 | N/A | 7.5 HIGH |
| Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service. | |||||
| CVE-2026-19395 | 2026-10-06 | N/A | N/A | ||
| In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device. | |||||
| CVE-2026-96422 | 1 Wireshark | 1 Wireshark | 2026-10-06 | N/A | 5.5 MEDIUM |
| Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-104428 | 2026-10-06 | N/A | 5.3 MEDIUM | ||
| The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop. | |||||
| CVE-2026-103100 | 1 Pexip | 1 Pexip Infinity | 2026-10-05 | N/A | 7.5 HIGH |
| Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service. | |||||
| CVE-2026-103104 | 1 Pexip | 1 Pexip Infinity | 2026-10-05 | N/A | 7.5 HIGH |
| Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. | |||||
| CVE-2026-103108 | 1 Pexip | 1 Pexip Infinity | 2026-10-05 | N/A | 7.5 HIGH |
| Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service | |||||
| CVE-2026-104434 | 2026-10-02 | N/A | 6.5 MEDIUM | ||
| ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an address to abort the zebrad process, repeatably keeping the node offline. | |||||
| CVE-2026-55776 | 2026-09-29 | N/A | 6.5 MEDIUM | ||
| OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5. | |||||
| CVE-2026-67303 | 1 Freerdp | 1 Freerdp | 2026-09-29 | N/A | 4.3 MEDIUM |
| FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service). | |||||