CVE-2026-102080 is an improper resource locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series devices. An unauthenticated, logically adjacent attacker can cause a denial-of-service (DoS) by sending malformed SyncE or PTP messages, triggering false alarms and persistent route engine switchovers. This issue is due to a race condition and affects multiple Junos OS versions prior to specific fixed releases.
CVE-2026-102083 is an improper resource locking vulnerability in the UTM WebFiltering subsystem of Juniper Networks Junos OS on SRX Series devices. When the WebFiltering cloud server is unreachable, sustained HTTP traffic can cause the UTM process to crash and restart, resulting in a denial-of-service (DoS) condition. This affects both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).
CVE-2026-105390 is a medium severity vulnerability in OpenVPN's ovpn-dco-win component for Windows. It affects versions from 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7. The flaw involves improper synchronization that allows local attackers to cause a deadlock by crafting a write to the ovpn-dco device, potentially making the host system unresponsive.
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g.databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system. Version 1.12.0 fixes the issue.
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability
An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.