We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems

The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...

Denial Of Service (DoS)

Apache Tomcat is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient enforcement of resource limits or throttling mechanisms in Apache Tomcat when handling client requests, allows an attacker to exhaust system resources by sending excessive or continuous requests,...

The vulnerability of Acronis Cyber Protect 16 software-related data protection software lies in improper configuration of access rights to important system resources, allowing attackers to enhance their privileges.

The vulnerability of Acronis Cyber Protect 16 software-related data protection software is related to incorrect configuration of access rights for important system resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2025-48381 CVAT has information disclosure via browsable API

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality...

CVE-2024-20864

Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources...

CVE-2023-6450

An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service...

CVE-2023-34154

Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources...

CVE-2021-36985

There is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and cause the system to restart...

CVE-2020-6855

A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...

CVE-2025-5024

A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer bei...

Resource Exhaustion

github.com/linkerd/linkerd2 is vulnerable to Resource Exhaustion. The vulnerability is due to unbounded generation or accumulation of proxy metrics, which allows an attacker to exhaust system resources in affected versions...

CVE-2025-20189

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 RSP3C could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition. This vulnerability is due to...

CVE-2025-20189

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 RSP3C could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition. This vulnerability is due to...

PT-2025-20261 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 RSP3C affected versions not specified Description: A vulnerability in the Cisco Express Forwarding functionality could allow an unauthenticated...

Do Not Allow Empty Links

Empty links are redundant files and waste system resources. In addition, if a file is installed or created at the target location of an empty link, the file can be accessed through the link, leading to possible information leakage or tampering. If the file to which the link points has been delete...

Do Not Install Insecure SNMP Versions

Simple Network Management Protocol SNMP is a standard protocol designed to manage network nodes in IP networks. This protocol allows the exchange of network management and control data between network elements NEs. If SNMP is installed in scenarios where SNMP is not required, additional system...

Do Not Install the Avahi Service

Avahi is a zero-configuration networking implementation, including a system for multicast DNS/DNS-SD service discovery and automatic broadcast. For example, you can connect a server to the network and use Avahi to automatically broadcast network services running on the server for other user to...

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow vulnerability

Talos Vulnerability Report TALOS-2024-2105 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow vulnerability April 14, 2025 CVE Number None,CVE-2025-2258 SUMMARY An integer underflow vulnerability exists in the HTTP server PUT request functionality of Eclipse ThreadX NetX Du...

Debian dsa-5892 : atop - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5892 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5892-1 [email protected] https://www.debian.org/security/ Moritz...

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

Description: PostQuantum-Feldman-VSS, a Python library implementing Feldman's Verifiable Secret Sharing scheme with post-quantum security, was vulnerable to denial-of-service attacks in versions up to and including 0.7.6b0. This vulnerability stems from the library's reliance on the gmpy2 library...