CVE-2026-75345
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to c
CVSS
7.5
Alto
EPSS
0.5%
p38
KEV
—
Exploit Today
12
0-100
Publicado: 9 oct 2026 · Última mod.: 13 oct 2026 · CWE-400
0.5%EPSS · 30 días0.5%
2026-10-102026-10-23
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/76b95cf/source/src/cip/cipcommon.c
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/76b95cf/source/src/cip/cipmessagerouter.c
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/76b95cf/source/src/cip/ciptcpipinterface.c
- github.comhttps://github.com/EIPStackGroup/OpENer/blob/76b95cf/source/src/enet_encap/endianconv.c
- github.comhttps://github.com/EIPStackGroup/OpENer/issues/569
- github.comhttps://github.com/EIPStackGroup/OpENer/tree/76b95cf
- github.comhttps://github.com/EIPStackGroup/OpENer/issues/569
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-86019—15.3%
——5Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.16hCVE-2026-86018—18.6%
——6Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.16hCVE-2026-798957.5 ALT24.2%
——7No description provided3hCVE-2026-798947.5 ALT24.2%
——7No description provided3hCVE-2026-1153905.7 MED7.6%
——2Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.6hCVE-2026-1153886.2 MED1.3%
——0wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.1d