By weakness (CWE)

CWE-1284: related vulnerabilities

CVEs classified under CWE-1284. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

23 published vulnerabilities

• CVE-2026-12059HIGH 8.8

  CelloOS, a system developed by Cellopoint, contains a flaw in its SSH service that allows authorized users to break free from command restrictions and run arbitrary operating system commands they shouldn't have access to. An attacker with valid credentials can exploit this to escalate privileges or gain broader system control than their account should permit.

• CVE-2026-49110HIGH 7.5

  The Upsell Order Bump Offer plugin for WooCommerce versions 3.1.4 and earlier contains an authentication bypass vulnerability that allows attackers to perform actions without logging in. An attacker can send specially crafted requests to the application to manipulate order data or modify plugin settings, potentially leading to unauthorized changes to orders or store configuration. This vulnerability requires no user interaction and can be exploited remotely by anyone with network access to the affected WooCommerce store.

• CVE-2026-49218HIGH 7.5

  ImageMagick, a widely used image editing and manipulation tool, contains a flaw in how it processes DCM (DICOM medical imaging) files. The vulnerability allows specially crafted DCM files with invalid dimensions to pass validation checks, potentially causing the application to crash when performing subsequent operations on the image. This is a denial-of-service issue affecting the availability of systems that rely on ImageMagick for image processing.

• CVE-2026-54234HIGH 7.5

  vLLM, a widely-used inference engine for large language models, contains a flaw in its speculative decoding logic that can crash the service. When processing certain multi-request workloads, the rejection sampler can generate an invalid token value that the engine mishandles, eventually triggering a GPU-side assertion failure. Because this crash can be triggered remotely via the public gRPC API, an unauthenticated attacker can repeatedly crash shared inference workers, disrupting service for all other users until manual restart. The issue affects all versions prior to 0.24.0.

• CVE-2026-55952HIGH 7.5

  A vulnerability in Erlang/OTP's TLS 1.3 implementation allows an unauthenticated attacker to crash the session ticket handler by sending a specially crafted TLS handshake message. When a TLS 1.3 server has session tickets enabled, the attacker can send a ClientHello with mismatched identity and binder lists, causing the handler process to crash. This disruption persists until the ssl application is restarted, rendering TLS 1.3 session ticket functionality unavailable on the affected listener. TLS 1.2 connections remain unaffected.

• CVE-2026-57023HIGH 7.5

  A flaw in Juniper Networks' TCP proxy functionality allows an attacker on the network to send a specially crafted TCP packet that crashes the flow processing daemon on vulnerable MX and SRX series routers. The crash causes a complete service outage until the system automatically restarts. No authentication is required—an attacker anywhere on the network can trigger this denial of service.

• CVE-2026-59879HIGH 7.5

  Immutable.js, a popular JavaScript library for working with immutable data structures, contains a critical flaw in how it handles large array indices and sizes. When developers use certain list operations with indices between roughly 1 billion and 2 billion, the library either freezes indefinitely, consumes all available memory, or silently produces incorrect results. This affects versions before 4.3.9 and 5.1.8. The vulnerability poses a significant availability risk to any application relying on Immutable.js for core data management, particularly those processing user-controlled list operations at scale.

• CVE-2026-53689HIGH 7.1

  A vulnerability in libnfs (an open-source NFS client library) allows attackers to trigger an integer overflow by connecting to a malicious NFS server that sends specially crafted data. The flaw stems from insufficient validation of string sizes during data parsing, potentially allowing an attacker to cause memory corruption, information disclosure, or limited system unavailability. An attacker would need to trick a user into connecting to a compromised or attacker-controlled NFS server, making this a network-based but not trivially exploitable threat.

• CVE-2026-11906MEDIUM 6.5

  IBM Db2 contains a vulnerability that allows authenticated users to crash the database by submitting specially crafted queries involving XMLTable-derived columns. An attacker with valid database credentials can trigger a denial of service condition, making the database unavailable to legitimate users. This requires authentication, so it is not exploitable by anonymous attackers, but it represents a risk from insider threats or compromised accounts.

• CVE-2026-54092MEDIUM 6.5

  File Browser versions prior to 2.63.6 contain a denial-of-service vulnerability in the login API that accepts arbitrarily large passwords without validation. An authenticated attacker can submit an extremely long password string, causing the application to consume excessive CPU and memory resources, leading to service degradation or complete failure. In containerized environments, this can crash the container, severely impact host system performance, and potentially trigger errors in the Docker daemon itself.

• CVE-2026-57019MEDIUM 6.5

  A vulnerability in Juniper Networks Junos OS on MX Series routers allows an attacker on the same local network to crash a Forwarding Card (FPC) by sending a specially crafted packet. The device incorrectly calculates packet size in certain traffic scenarios, causing processing to fail and triggering a hardware reset. While the system recovers automatically, traffic is interrupted until that recovery completes, making this a localized denial-of-service risk for networks running vulnerable MX platforms.

• CVE-2026-55706MEDIUM 5.8

  A flaw in OpenBSD's serialized-line-protocol (SPPP) implementation allows attackers on an adjacent network to bypass authentication by supplying specially crafted zero-length values during the PAP (Password Authentication Protocol) exchange. The vulnerability resides in the input validation logic of the sppp_pap_input function and requires local network access but no user interaction to exploit. Successful exploitation leads to unauthorized access to authenticated services, potentially compromising confidentiality, integrity, and availability.

• CVE-2026-52905MEDIUM 5.5

  A bug in the Linux kernel's DAMON (Data Access Monitoring) subsystem allows administrators or local users to configure memory monitoring settings with invalid parameters, potentially causing system instability or denial of service. The vulnerability stems from incomplete validation of the minimum region size parameter—it must be a power of two, but the DAMON sysfs interface can accept non-power-of-two values, leading to unaligned memory address ranges that violate kernel assumptions. This creates conditions for crashes or hangs during memory access monitoring operations.

• CVE-2026-55392MEDIUM 5.5

  A vulnerability in NILFS utilities versions up to 2.3.0 allows attackers to crash system administration tools by providing specially crafted NILFS2 disk images. The flaw stems from insufficient validation of a critical superblock field before the tools perform mathematical operations on it. While no remote exploitation is possible, anyone with local access to a system or the ability to provide a malicious disk image can trigger a denial of service.

• CVE-2026-9801MEDIUM 4.9

  Keycloak has a vulnerability that allows a high-privileged attacker—such as a realm administrator or someone who has compromised an upstream LDAP server—to crash the Keycloak service by sending a specially crafted LDAP password policy response. When triggered during authentication, this causes the Java process to run out of memory and shut down, knocking the service offline for all users on that node. The attack requires either legitimate administrative access to configure a malicious LDAP directory or prior compromise of an existing LDAP backend.

• CVE-2026-11596MEDIUM 4.7

  ScreenConnect versions before 26.2 contain a weakness in how it validates input when administrators or authorized users create Host Pass tokens—special access credentials that grant temporary delegated access. An authenticated user with Host Pass creation privileges can bypass the intended expiration time limits and specify tokens that remain valid far longer than intended, potentially allowing extended unauthorized access to systems after the token should have expired.

• CVE-2026-59930MEDIUM 4.3

  Mistune, a popular Python Markdown parser, contains a predictability flaw in how it generates anchor IDs for table-of-contents elements. Before version 3.3.0, the toc plugin and TableOfContents directive create heading IDs using a simple sequential pattern (toc_1, toc_2, etc.) without considering the actual heading text. An attacker who controls Markdown content can craft headings with matching IDs that collide with these predictable anchors, potentially redirecting users to unintended locations or interfering with page navigation and styling rules that depend on those IDs.

• CVE-2026-59997MEDIUM 4.2

  OpenSSH's internal SFTP server has a parsing limitation where only the first 9 command-line arguments are processed. Any security-relevant parameters supplied as the 10th argument or beyond are silently ignored. This can lead to SFTP connections operating with weaker security properties than an administrator intended, since critical flags meant to restrict access or enforce specific protections would be overlooked during connection setup.

• CVE-2026-57053MEDIUM 4.0

  GNU libidn, a widely-used library for handling internationalized domain names, contains a flaw in its ToUnicode conversion APIs that can read uninitialized memory from your system. This occurs when the library processes certain domain name conversions, potentially exposing sensitive data that happened to be in memory. The vulnerability affects libidn versions before 1.44; the newer libidn2 implementation does not have this issue. While the attack requires local access and specific conditions to trigger, the combination of memory disclosure and potential data corruption makes it a meaningful security concern for systems that process untrusted international domain names.

• CVE-2026-53540LOW 3.7

  Python-Multipart, a streaming multipart parser library, contains a vulnerability in how it handles the Content-Length header when parsing form submissions. Before version 0.0.31, the parser fails to validate whether the Content-Length value is valid. An attacker who can send a request with a negative Content-Length header can force the parser to read the entire request body into memory at once, rather than processing it in manageable chunks. This memory exhaustion condition can cause the application to become unresponsive or crash.

• CVE-2026-47329LOW 3.3

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a flaw in SAUCE patches that handle AppArmor security notifications. The vulnerability stems from improper validation of the name field size in these notifications. An unprivileged local user can exploit this by sending crafted AppArmor responses that bypass validation checks, potentially leading to unexpected behavior in the kernel's handling of these security-related messages. This is a local-only issue with low severity impact.

• CVE-2026-57062LOW 2.9

  GnuPG's gpgsm tool, which handles digitally signed and encrypted messages in a standard format called CMS (Cryptographic Message Syntax), has a flaw in how it validates a specific cryptographic parameter. When using AES-GCM encryption, the tool should reject messages where a security tag is shorter than 12 bytes, but instead it incorrectly accepts messages with a 4-byte tag. This laxness in validation could allow an attacker to forge or tamper with encrypted messages in ways that might not be detected, though the practical impact is limited and requires local access.

• CVE-2026-12755LOW 2.7

  Devolutions Server contains a flaw in how it validates user input on Active Directory discovery endpoints used for PAM (Privileged Access Management) functions. An authenticated user with UserGroupsView permission can manipulate the DomainName parameter to trick the server into attempting authentication to a system they control, thereby capturing NTLMv2 credential hashes from the PAM provider. This is a credential exposure risk limited to authenticated users with specific permissions.