CVE-2026-113380Critical· 9.3▾ MidnightIn the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
0.3% → 0.9%
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
RingRTC < 2.72.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116516Medium· 6.5Insufficient length validation when parsing Zoom chat transcriptions
CVE-2026-106070Low· 3.7nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)
CVE-2026-115385Medium· 6.2Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
CVE-2026-13411Medium· 4.3Null condition in Playbooks import crashes the plugin
CVE-2026-86412Noneserver-set cookie erases cookie jar
CVE-2026-48741High· 7.5libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS