Denial Of Service (DoS)

github.com/free5gc/nssf is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of crafted POST requests to the NnssfNSSAIAvailability API, which allows an attacker to disrupt service availability...

Denial Of Service (DoS)

github.com/free5gc/pcf is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of crafted POST requests to the NpcfBDTPolicyControl API, which allows an attacker to trigger service disruption...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the RechargePut function in the nchf-convergedcharging service. An attacker can cause a server-side panic and disrupt recharge functionality by sending a crafted authenticated PUT request with an...

CVE-2026-32941 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM Out-of-Memory vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an...

OneUptime 数据伪造问题漏洞

OneUptime is a comprehensive solution developed by OneUptime OpenSource. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.34 contained a data manipulation vulnerability. This vulnerability stemmed from the WhatsApp POST webhook processor not verifying the...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard in the TLS 1.2 server state machine implementation. An attacker can disrupt the handshake process or potentially compromise the security of the TLS session by sending a CertificateVerif...

GHSA-3366-GW57-FCM5 Ella Core panics on malformed ULNASTransport Message without a Request Type

Summary Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type. Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Add a guar...

Ella Core panics on malformed ULNASTransport Message without a Request Type

Summary Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type. Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Add a guar...

GHSA-Q669-4GMV-G8MF Ella Core panics on invalid PDU Session IDs in NGAP messages

Summary Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Added PDU...

Akamai Helps Authorities Disrupt the World’s Largest IoT Botnets

The U.S. DOJ recently disrupted several large and powerful DDoS botnets and shut down their related DDoS-for-hire services with Akamai’s help...

CVE-2026-28461 OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different que...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.1 contained security vulnerabilities. These vulnerabilities stemmed from an unlimited memory growth issue in the Zalo webhook endpoint. This could allow unverified attackers to...

PT-2026-26467

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.6.0 Description Ella Core, a 5G core designed for private networks, experiences a panic when processing NGAP messages containing invalid PDU Session IDs outside the range of 1-15. An attacker capable of sending...

The vulnerability of the `nvme_fc_create_association()` function in the drivers/nvme/host/fc.c module of the Linux operating system’s NVME kernel driver allows a attacker to cause a service failure.

The vulnerability of the nvmefccreateassociation function in the drivers/nvme/host/fc.c file of the Linux kernel’s NVME driver is related to the lack of synchronization. Exploiting this vulnerability could allow a attacker to cause a service failure...

The vulnerability of the scs_check_usage() function in the kernel/scs.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the scscheckusage function in the kernel/scs.c module of the Linux operating system is related to the improper disabling or release of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the WebSocket message handler in kernel/server/serve.go. An attacker can crash the kernel process and disrupt service availability by sending malformed JSON over an unauthenticated...

Missing Authorization

Overview frigate is an A tool for autogenerating helm documentation. Affected versions of this package are vulnerable to Missing Authorization via the DELETE /api/users/admin endpoint. An attacker can remove privileged user accounts and disrupt service availability by sending crafted requests wit...

CVE-2026-22321

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain...

GHSA-XV6H-R36F-3GP5 Keycloak: Denial of Service due to excessive SAMLRequest decompression

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the proxy module due to blindly trusting ExternalIPs/LoadBalancer IPs. An attacker can redirect cluster-wide network traffic or disrupt DNS services by assigning arbitrary external IPs or loadBalancer IPs withou...