A public proof-of-concept denial-of-service exploit has been published for the EVerest 2025.9.0 open-source EV charging framework.
Exploit-DB lists a denial-of-service proof of concept targeting EVerest version 2025.9.0. EVerest is an open-source software framework used for EV charging infrastructure. No in-the-wild exploitation or CVE mapping is stated in the listing.
A denial-of-service proof-of-concept targeting NanaZip 6.5 has been published on Exploit-DB.
Exploit-DB entry 52656 contains a public proof-of-concept that triggers a denial-of-service condition in NanaZip 6.5. The listing is limited to the vulnerability title and does not include CVE identifiers or details on exploitation conditions. No evidence of in-the-wild exploitation is provided.
A denial-of-service proof of concept for NanaZip 6.5 was published on Exploit-DB.
Exploit-DB carries a denial-of-service proof-of-concept targeting NanaZip version 6.5. NanaZip is an open-source file archiver packaged for Windows. The entry cites no CVE id and no evidence of active exploitation.
FortiOS web interface is vulnerable to unauthenticated slow HTTP denial-of-service attacks via crafted requests (CVSS 5.0).
Fortinet advisory FG-IR-26-162 details an unbounded resource allocation flaw (CWE-770) in FortiOS, scored CVSSv3 5.0. An unauthenticated attacker can launch a slow HTTP denial-of-service attack against the FortiOS web interface using crafted HTTP requests. The advisory was revised on 2026-08-12 and does not state that exploitation has been observed.
Apache OpenNLP CVE-2026-67211: unbounded map pre-sizing in SymSpellModelSerializer enables out-of-memory denial of service in opennlp-symspell 3.0.0-M4/M5.
CVE-2026-67211 affects the opennlp-symspell artifact in versions 3.0.0-M4 and 3.0.0-M5 only. The SymSpellModelSerializer.create() method performs unbounded map pre-sizing, allowing crafted input to trigger out-of-memory denial of service. Releases 1.x and 2.x are unaffected because the spellcheck extension was introduced in 3.0.0-M4; the issue is resolved in 3.0.0-M6.
A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.
Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.
Cisco warns of a DoS flaw in SIP software on Desk Phone 9800 and IP Phone 7800/8800 series from improper HTTP packet memory handling.
Cisco disclosed a denial of service vulnerability affecting Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 devices running Cisco SIP Software. An unauthenticated remote attacker can send a continuous stream of crafted HTTP packets, causing sustained memory consumption until the device becomes unresponsive. A manual reboot is required to recover an affected device. No CVE identifier was listed in the advisory text.
Cisco released a fix for a management-plane flooding DoS in IE-1000 switches that can make the device manager, SSH, or API inaccessible.
Insufficient protection against management plane flooding in Cisco Industrial Ethernet 1000 Series Switches allows an unauthenticated remote attacker to send high-rate ICMP, SSH, or HTTP traffic, raising CPU usage and causing a denial-of-service condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected. Cisco has released software updates to address the issue.
Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.
Ubuntu published security notice USN-8744-1 addressing two Python vulnerabilities affecting Ubuntu 14.04 LTS through 24.04 LTS. CVE-2026-3644 concerns incorrect handling of control characters in the http.cookies module, which could allow an attacker to inject arbitrary content. The second issue involves unbounded recursion in the Expat XML parser reached via the pyexpat module, which could crash Python and cause a denial of service. Updated packages are available; no exploitation in the wild is reported.
Ubuntu issued USN-8731-1 fixing a MiniUPnPd integer underflow allowing remote DoS or information disclosure via malformed SOAPAction headers.
Ubuntu released USN-8731-1 to address an integer underflow vulnerability in MiniUPnPd's SOAPAction header parsing. A remote attacker could send a malformed SOAPAction header containing a single quote to trigger a denial of service or information disclosure. MiniUPnPd is a lightweight UPnP daemon widely deployed on routers and gateways.
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.
CISA warns Mitsubishi Electric CC-Link IE TSN remote I/O modules are vulnerable to denial-of-service via crafted UDP packets (CVE-2025-3511).
CISA published Update D of advisory ICSA-25-128-03 covering Mitsubishi Electric factory automation products. Affected products include CC-Link IE TSN Remote I/O modules NZ2GN2S1-32D, NZ2GN2S1-32T, NZ2GN2S1-32TE, and NZ2GN2S1-32DT at firmware version 09 or earlier (CVE-2025-3511). A remote attacker can send a specially crafted UDP packet to cause denial-of-service conditions, timeout errors, or communication delays on the affected products.
Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.
Unit 42 collected roughly 10,700 unique Go-compiled malware samples and found that Go usage by malware developers has steadily risen in recent months. About 92% of samples targeted Windows and 75% were attributed to known families, led by Veil, GoBot2, and HERCULES. The most prevalent groupings were penetration testing tools, remote access Trojans, and backdoors. Statically linked Go binaries average 4.65MB, which can complicate phishing delivery but sometimes causes antivirus products to skip or fail scanning.