CVE-2026-43806
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.6. A local attacker may be ab
CVSS
5.5
Medio
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 27 jul 2026 · Última mod.: 24 oct 2026 · CWE-400
0.1%EPSS · 30 días0.1%
2026-09-282026-10-26
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.6. A local attacker may be able to cause a denial of service.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-771677.5 ALT—
———Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.5hCVE-2026-1175064.3 MED—
———A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.6hCVE-2026-1175054.3 MED—
———A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue. The patch is named be663f806efcfdddd2805d214fae4998379ac5f2. It is advisable to upgrade the affected component.6hCVE-2026-1175035.3 MED—
———A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.7hCVE-2026-1168787.5 ALT—
——0Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.7hCVE-2026-703805.3 MED—
——0A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists.
Miracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.6h