Latest high and critical flaws
- CVE-2026-85449 MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by suHigh 8.7 · Sep 3, 2026
- CVE-2026-85448 MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing().High 8.7 · Sep 3, 2026
- CVE-2026-85447 MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits.High 8.7 · Sep 3, 2026
- CVE-2026-85446 MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers High 8.7 · Sep 3, 2026
- CVE-2026-85445 MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers High 8.7 · Sep 3, 2026
- CVE-2026-85444 MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using tHigh 8.7 · Sep 3, 2026
- CVE-2026-85439 MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize sheHigh 8.5 · Sep 3, 2026
- CVE-2026-85438 MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloadCritical 9.3 · Sep 3, 2026
- CVE-2026-85437 MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without vCritical 9.3 · Sep 3, 2026
- CVE-2026-85435 MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-conCritical 9.3 · Sep 3, 2026
- CVE-2026-85434 MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes.Critical 9.3 · Sep 3, 2026
- CVE-2026-85429 MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source.High 8.7 · Sep 3, 2026
- CVE-2026-85426 MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization.Critical 9.3 · Sep 3, 2026
- CVE-2026-85425 MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command.Critical 9.3 · Sep 3, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.