CVE-2026-85447

MOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of Service

MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-lived pipeways with many variables to cause pRealm to generate excessive output indefinitely, exhausting system resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85446

MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85445

MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85444

MOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevroned

MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85443

MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no data, causing the accept thread to block indefinitely while holding the socket-list lock, preventing all subsequent client connections.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-85442

MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-85441

MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-85440

MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-85439

MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85438

MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts

MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85437

MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85436

MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.

CVSS 4.0 · 8.7 High EPSS 2.1% KEV · Not listed

Vendors

Themoos

Products

Essential-moos

CVE-2026-85435

MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85434

MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-74769

Incorrect Authorization in PowerProtect Data Manager REST API Allows Protection Mechanism Bypass

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerprotect Data Manager

CVE-2023-7104

SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Fedoraproject Redhat Sqlite

Products

Fedora Enterprise Linux Openshift and 3 more

CVE-2023-31436

kernel: out-of-bounds write in qfq_change_class function

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 6 more

CVE-2023-31085

kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2023-29499

Gvariant offset table entry size is not checked in is_normal()

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Enterprise Linux

CVE-2023-29491

ncurses: Local users can trigger security-relevant memory corruption via malformed data

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Invisible-island Redhat

Products

Ncurses Enterprise Linux Rhel Eus