Tag: dos

All entries tagged dos.

• 22 CVEs in Tobit TeamDavid, a DACH-region self-hosted Microsoft 365 alternative: an unauthenticated heap leak hands over stored mailbox passwords, and the vendor stopped responding
  2026-08-09 · vulnerability · high
• CISA publishes five protocol-level flaws in CPDLC over ATN-B1, reported by a Swiss armasuisse researcher — no mitigation available, and CISA assesses exploitation unlikely outside a lab
  2026-08-08 · vulnerability · routine
• Bouncy Castle for Java 1.85 — 32 CVEs published three weeks after the silent fix: three certificate-validation bypasses and a static Diffie-Hellman key-recovery flaw rated critical
  2026-08-03 · vulnerability · high
• CVE-2026-7849 and 19 more — Phoenix Contact CHARX SEC-3xxx EV charging controllers: unauthenticated command injection as root, unsigned firmware updates, and no fix released at disclosure
  2026-08-02 · vulnerability · high
• CVE-2023-4346 — KNX building-automation protocol: account-lockout DoS added to CISA KEV, no software patch (CVSS 7.5)
  2026-07-16 · vulnerability · notable
• Progress MOVEit Transfer: pre-auth SFTP DoS (CVE-2026-10699), admin table-scope bypass (CVE-2026-10698) and stored XSS (CVE-2026-11903), patched 2026.0.2
  2026-07-11 · vulnerability · notable
• CVE-2026-20744 — Hydro-Québec EV-charging backend: unauthenticated OCPP WebSocket endpoint enables privilege escalation
  2026-07-08 · vulnerability · notable
• CVE-2026-55200 / CVE-2026-55199 — libssh2 heap out-of-bounds write with public PoC
  2026-06-29 · vulnerability · notable
• CVE-2026-55200 — libssh2 heap out-of-bounds write in ssh2_transport_read() with public PoC; companion pre-auth DoS CVE-2026-55199
  2026-06-28 · vulnerability · high
• CVE-2026-0647 et al. — Rockwell Automation FLEX I/O unauthenticated password reset (9.4) and Logix CIP DoS, flagged by NCSC-CH
  2026-06-22 · vulnerability · notable
• CVE-2026-0647 et al. — Rockwell Automation FLEX I/O unauthenticated password reset (CVSS 9.4) and Logix CIP denial-of-service, flagged by NCSC-CH
  2026-06-18 · vulnerability · high
• CVE-2026-28318 — SolarWinds Serv-U: unauthenticated DoS added to CISA KEV
  2026-06-06 · vulnerability · high
• HTTP/2 Bomb (CVE-2026-49975): a single-connection memory-exhaustion DoS against every major web server
  2026-06-04 · vulnerability · high
• CVE-2026-49975 — HTTP/2 Bomb: HPACK amplification + Slowloris chains to single-connection RAM exhaustion, patch status split by server
  2026-06-01 · vulnerability · notable
• DNS-resolver patch cluster — Unbound 1.25.1 (11 CVEs) and ISC BIND 9.18.49 / 9.20.23
  2026-05-24 · vulnerability · high
• CVE-2026-42945 NGINX Rift — in-the-wild exploitation confirmed by VulnCheck honeypots
  2026-05-18 · vulnerability · high
• DENIC .de DNSSEC outage — 3.5 h registry-side trust failure traced to keytag 33834 collision and an alerting-layer fire-without-page
  2026-05-04 · incident · notable