CWE-404 vulnerabilities

A vulnerability in multer versions 2.0.0 through before 2.5.0 allows a Node.js process to crash when using an asynchronous fileFilter. If a request is aborted while the asynchronous fileFilter is pending, an unhandled error event occurs due to a resumed parsing stream without an error listener, causing the process to exit. This issue is fixed in multer 2.5.0.

CVE-2026-49785 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper resource shutdown or release in the Windows UEFI component. This flaw allows an authorized local attacker to bypass a security feature. The issue affects multiple Windows 10 versions prior to specific fixed releases. A patch is available from Microsoft to address this vulnerability.

ImageMagick versions before 7.1.2-32 have a vulnerability in the -script operation that allows bypassing security policies by improperly handling file descriptors. This flaw enables attackers with limited privileges to close file descriptors not opened by the current operation, potentially circumventing configured restrictions.

CVE-2026-90440 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves uncaught exceptions and improper handling of exceptional conditions in the thrift.server.nonblocking.TNonblockingServer component, leading to improper resource shutdown. This can cause service disruption or other impacts related to resource management. Users are advised to upgrade to Apache Thrift version 0.25.0, which addresses this issue.

CVE-2026-47491 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It involves improper resource shutdown or release in the kernel mode layer, allowing an unprivileged user to cause memory resources to be improperly released. This can leave a memory mapping accessible after the underlying memory is reused. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

A security flaw in GNU Binutils 2.47 affects the elf_orphan_compatible function in the ELF Orphan Section Handler, causing a null pointer dereference. Exploitation requires local access and can result in limited confidentiality, integrity, and availability impacts. Public exploit code exists, but no vendor patch or official fix has been issued yet. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.

A denial of service vulnerability exists in FFmpeg 8.0.x within the parse_playlist function of libavformat/hlsproto.c. The issue arises from manipulation of the duration or target_duration arguments. Remote attackers can exploit this flaw to cause a denial of service. Upgrading to FFmpeg versions 8.1 or 9.0 mitigates the vulnerability.

Apache Nutch versions 1.10 through 1.22 contain a critical vulnerability involving missing authorization in the Nutch Server REST API. This flaw allows unauthorized access to the service, leading to potential information disclosure and denial of service due to improper resource shutdown and job interruption. The vulnerability is addressed by removing the Nutch Server in version 1.23. Users unable to upgrade should restrict access to trusted users only.

CVE-2026-17610 is a medium severity vulnerability in Silicon Labs SiSDK versions 2026.6.0 and earlier. It affects EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, a dropped ACK can cause a denial of service. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-78148 is a medium severity vulnerability in the ggml-org llama.cpp project. It involves a null pointer dereference in the rpc_server::graph_compute function of the ggml-RPC Server component. This flaw can be triggered remotely and may cause a denial of service. A fix has been proposed but is not yet merged or officially released.

A null pointer dereference vulnerability exists in BusyBox up to version 1.30.1 in the FEATURE_WGET_TIMEOUT handler within networking/wget.c. This issue can be triggered by manipulating the -T argument. Local access is required to exploit this vulnerability. A patch identified by commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff has been made available to address this issue. The vulnerability has a CVSS score of 3.3, indicating a medium severity level.

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVE-2026-11317 is a high-severity denial of service vulnerability in Rockwell Automation CompactLogix and ControlLogix devices. The issue arises from improper resource shutdown or release when a specially crafted CIP message is processed. Devices with limited memory are more susceptible, potentially causing a major nonrecoverable fault that requires a program download to recover. No patch or official remediation has been confirmed yet.

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.