CVE-2026-77798
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the u
CVSS
6.5
Média
EPSS
0.2%
p10
KEV
—
Exploit Today
3
0-100
Publicado: 24 de set. de 2026 · Última mod.: 24 de set. de 2026 · CWE-833
0.2%EPSS · 30 dias0.2%
2026-10-082026-11-05
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-118052—1.4%
——0In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.4dCVE-2026-105390—1.5%
——0Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.22dCVE-2026-701867.5 ALT61.6%
——18Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.24dCVE-2026-1035587.5 ALT62.3%
——19Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.11dCVE-2026-1057926.5 MÉD53.0%
——16Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then calls SessionManager.get_result() to acquire the same lock again when the task name maps to a session. An authenticated caller who knows or creates a mapped task name can therefore block the request indefinitely, and in the default single-process server configuration the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions. Unknown task names do not reach the nested call and are not affected. This issue is fixed in version 3.0.9.31dCVE-2026-463527.5 ALT40.8%
——12Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.39d