CVE-2026-75350
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Ge
CVSS
7.5
High
EPSS
0.5%
p40
KEV
—
Exploit Today
12
0-100
Published: Oct 9, 2026 · Last modified: Oct 16, 2026 · CWE-400
0.5%EPSS · 30 days0.5%
2026-10-102026-10-23
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service
- github.comhttps://github.com/EIPStackGroup/OpENer
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/master/source/src/cip/cipcommon.c
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/cpf.c
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/endianconv.c
- github.comhttps://github.com/EIPStackGroup/OpENer/issues/576
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-86019—15.3%
——5Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.16hCVE-2026-86018—18.6%
——6Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.16hCVE-2026-798957.5 HIG24.2%
——7No description provided3hCVE-2026-798947.5 HIG24.2%
——7No description provided3hCVE-2026-1153905.7 MED7.6%
——2Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.6hCVE-2026-1153886.2 MED1.3%
——0wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.1d