PULSE
EN
FEED
ransomobsoft reclama a Company #2 · KRransomobsoft reclama a New Victim Company #6ransompixelleaks reclama a Unnamed · ITransompayload reclama a Stahlbau Mann GmbH · DE · Manufacturingransomn0n reclama a Company #122 · USransomn0n reclama a Company #121 · USransomn0n reclama a Company #120 · USransomn0n reclama a Company #119ransomn0n reclama a Company #118 · AEransomnightspire reclama a REFSA S.A. · AR · Otherransomsilentransomgroup reclama a S... G...ransomqilin reclama a Isapre Consalud · CL · Healthcareransomorova reclama a Harry's International · SG · Retail & E-Commerceransomeverstake reclama a da*****t.com · Technologyransomobsoft reclama a Company #2 · KRransomobsoft reclama a New Victim Company #6ransompixelleaks reclama a Unnamed · ITransompayload reclama a Stahlbau Mann GmbH · DE · Manufacturingransomn0n reclama a Company #122 · USransomn0n reclama a Company #121 · USransomn0n reclama a Company #120 · USransomn0n reclama a Company #119ransomn0n reclama a Company #118 · AEransomnightspire reclama a REFSA S.A. · AR · Otherransomsilentransomgroup reclama a S... G...ransomqilin reclama a Isapre Consalud · CL · Healthcareransomorova reclama a Harry's International · SG · Retail & E-Commerceransomeverstake reclama a da*****t.com · Technology
← Todos los CVEs
CVE Watch23 sept 2026

CVE-2026-87274

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.

CVSS

4.4

Medio

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Publicado: 15 sept 2026 · Última mod.: 23 sept 2026 · CWE-400

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-10-052026-11-01
Descripción técnica

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H).

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1175315.9 MED
—
——0@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.19hCVE-2026-1011745.7 MED
—
——0DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.16hCVE-2026-1011736.5 MED
—
——0DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.16hCVE-2026-1202374.3 MED
—
——0A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.20hCVE-2026-1202354.3 MED
—
——0A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.18hCVE-2026-1202344.3 MED
—
——0A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.20h