CVE-2026-105390
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers
CVSS
—
Sin CVSS
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 13 oct 2026 · Última mod.: 15 oct 2026 · CWE-413 · CWE-833
0.1%EPSS · 30 días0.1%
2026-10-142026-10-20
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1020835.9 MED22.8%
——7An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered.
When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process.
This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).
This issue affects Junos OS on SRX Series:
* 23.2 versions from 23.2R2 before 23.2R2-S7.7;
* 23.4 versions from 23.4R2 before 23.4R2-S8.13;
* 24.2 versions before 24.2R2-S5.5;
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R2-S1;
* 25.4 versions before 25.4R1-S3, 25.4R2.6dCVE-2026-1020805.3 MED7.4%
——2An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS).
If a SyncE or PTP upstream node sends a malformed message to an MX device equipped with SCBE3, a false 19.44MHz alarm is generated on the master RE. This leads to persistent RE switchovers and a clksyncd process crash. This issue is outside the attacker's direct control as it's a race condition.
This issue affects Junos OS on MX Series:
* All versions before 23.2R2-S7.7;
* 23.4 versions before 23.4R2-S8.13;
* 24.2 versions before 24.2R2-S5.5;
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R2-S1;
* 25.4 versions before 25.4R1-S2.6dCVE-2026-701867.5 ALT57.4%
——17Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.8dCVE-2026-1035587.5 ALT58.5%
——18Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.5dCVE-2026-1057926.5 MED52.0%
——16Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then calls SessionManager.get_result() to acquire the same lock again when the task name maps to a session. An authenticated caller who knows or creates a mapped task name can therefore block the request indefinitely, and in the default single-process server configuration the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions. Unknown task names do not reach the nested call and are not affected. This issue is fixed in version 3.0.9.15dCVE-2026-777986.5 MED9.1%
——3Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.27d