Do Son A high-severity DoS flaw (CVE-2025-8696) in Stork UI allows unauthenticated attackers to crash the server with excessive data, leading to resource exhaustion.
Denial of Service
A critical flaw (CVE-2025-58063) in the CoreDNS etcd plugin allows attackers to pin DNS cache entries for years, causing a denial of service for service updates.
A critical flaw in ABB ASPECT BMS (CVE-2025-53187) allows unauthenticated remote attackers to achieve RCE with a CVSS 9.8 score. Admins must patch or disconnect systems.
A critical RCE flaw (CVSS 10.0) in the DeepDiff Python library allows for arbitrary code execution via class pollution. A PoC is public, and patching is urgent.
HashiCorp has issued a security advisory for a high-severity DoS flaw (CVE-2025-6203) in Vault. A malicious JSON payload could make a server unresponsive.
MediaTek's September security bulletin warns of high-severity flaws in its modem that can be exploited by rogue cellular base stations for remote privilege escalation or DoS.
A high-severity DoS flaw (CVE-2024-58259) in Rancher Manager allows attackers to crash servers by sending oversized API requests. Admins are urged to patch immediately.
A high-severity DoS flaw (CVE-2025-58047) in Volto, the frontend for Plone CMS, allows an unauthenticated user to crash the server with a single crafted URL.
Cisco has issued a security advisory for a high-severity DoS vulnerability (CVE-2025-20241) in its Nexus switches that could allow an unauthenticated attacker to crash a device.
A new report reveals a high-severity flaw (CVE-2025-40779) in the Kea DHCP server that allows a single crafted packet to crash the service, leading to a DoS condition.
A new vulnerability, "MadeYouReset," has been discovered in HTTP/2, allowing attackers to exploit stream resets to launch devastating denial-of-service attacks.
A critical 9.8-rated vulnerability in the popular "Database for Contact Form 7" plugin could let unauthenticated attackers delete files and gain full control of sites.
A critical flaw in Apache bRPC's Redis parser (CVE-2025-54472) allows unauthenticated remote attackers to crash services via a memory allocation bug. Update to 1.14.1 immediately!
SonicWall discloses CVE-2025-40600, a critical format string vulnerability in SonicOS SSL VPN, allowing unauthenticated remote DoS attacks on Gen7 firewalls. Update to 7.3.0-7012 or later.
A vulnerability (CVE-2025-8194, CVSS 7.5) in Python's tarfile module allows attackers to cause infinite loops and DoS by processing maliciously crafted archives. Patch immediately!
SonicWall SMA 100 series has buffer overflow and XSS flaws (CVSS 6.3-7.3) exploitable by unauthenticated attackers via the web interface. Update to 10.2.2.1-90sv immediately!
Dahua IP cameras are vulnerable to two high-severity buffer overflow flaws (CVE-2025-31700, CVE-2025-31701) allowing remote attackers to crash devices or execute arbitrary code. Update firmware immediately.
CISA and Schneider Electric warn of critical, actively exploited RCEs in EcoStruxure Power Operation (EPO), impacting industrial control systems. Public exploits are available.
Two new medium-severity vulnerabilities (CVE-2025-53816, -53817) in 7-Zip versions prior to 25.0.0 risk memory corruption and denial of service. Update immediately.
Apache CXF versions are vulnerable to DoS attacks and sensitive data leaks (CVE-2025-48795) due to improper handling of large messages. Update immediately!
A critical XXE flaw (CVE-2025-53689) in Apache Jackrabbit allows blind XXE attacks for data exfiltration, DoS, or internal file exposure. Update to patched versions immediately!
A critical flaw (CVE-2025-7206, CVSS 9.8) in D-Link DIR-825 firmware 2.10 allows unauthenticated remote buffer overflow, crashing the web interface.