PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransomrhysida reclama a INTAX, Inc. · Financial Servicesransomkrybit reclama a www.viehhauser-kfz.at · AT · Transportationransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransomrhysida reclama a INTAX, Inc. · Financial Servicesransomkrybit reclama a www.viehhauser-kfz.at · AT · Transportationransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Services

← Todos los CVEs

CVE Watch29 oct 2026

CVE-2026-111735

P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 29 oct 2026 · Última mod.: 29 oct 2026 · CWE-125 · CWE-191

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.

Referencias oficiales

rt-labs.comhttps://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-908697.5 ALT

———A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.3h CVE-2026-115795—

———P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access.3h CVE-2026-111734—

———P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.3h CVE-2026-930094.3 MED

———A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.5h CVE-2026-1190535.3 MED

———lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.3h CVE-2026-115942—

——0A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.4h