PULSE
EN
FEED
ransomumbra reclama a Tharisa · ZA · Manufacturingransomn0n reclama a Chibitek · US · Technologyransomincransom reclama a acmestamping.com · US · Manufacturingransomincransom reclama a harborpacific.com · US · Transportationransomincransom reclama a architekt-vondanwitz.de · DE · Professional Servicesransomtermite reclama a Aon · US · Professional Servicesransomqilin reclama a EPTISA · ES · Professional Servicesransomsilentransomgroup reclama a Andersen Group · Professional Servicesransompanzer reclama a EDFelectronics · Manufacturingransomumbra reclama a Beni Suef Technological University – BTU · EG · Educationransomvexy ransomware reclama a KOOKABARRA JUICE · AU · Retail & E-Commerceransomqilin reclama a BNYH · Financial Servicesransomqilin reclama a Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi · TR · Manufacturingransompanzer reclama a SweetRush · US · Professional Servicesransomumbra reclama a Tharisa · ZA · Manufacturingransomn0n reclama a Chibitek · US · Technologyransomincransom reclama a acmestamping.com · US · Manufacturingransomincransom reclama a harborpacific.com · US · Transportationransomincransom reclama a architekt-vondanwitz.de · DE · Professional Servicesransomtermite reclama a Aon · US · Professional Servicesransomqilin reclama a EPTISA · ES · Professional Servicesransomsilentransomgroup reclama a Andersen Group · Professional Servicesransompanzer reclama a EDFelectronics · Manufacturingransomumbra reclama a Beni Suef Technological University – BTU · EG · Educationransomvexy ransomware reclama a KOOKABARRA JUICE · AU · Retail & E-Commerceransomqilin reclama a BNYH · Financial Servicesransomqilin reclama a Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi · TR · Manufacturingransompanzer reclama a SweetRush · US · Professional Services
← Todos los CVEs
CVE Watch6 oct 2026

CVE-2026-102413

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elas

CVSS

6.2

Medio

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-248

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-96399—
—
——0A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users.20hCVE-2026-106122—
—
——0The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.20hCVE-2026-1057576.5 MED
22.0%
——7vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.1dCVE-2026-1057566.5 MED
22.0%
——7vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.1dCVE-2026-588597.8 ALT
0.0%
——0In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.1dCVE-2026-96286—
34.7%
——10Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.5d