CVE-2026-72813 | | | 2026-08-14 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to… |
CVE-2026-72660 | Medium | 6.5 | 2026-08-13 | Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153… |
CVE-2026-49096 | Medium | 4.3 | 2026-08-13 | Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comm… |
CVE-2026-73418 | High | 7.5 | 2026-08-12 | NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next… |
CVE-2026-18675 | | | 2026-08-12 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |
CVE-2026-20775 | | | 2026-08-11 | Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user co… |
CVE-2026-52856 | High | 7.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SF… |
CVE-2026-65834 | Medium | 6.8 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and Capsule… |
CVE-2026-13697 | High | 7.4 | 2026-07-29 | undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response… |
CVE-2026-47219 | High | 7.5 | 2026-07-28 | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are v… |
CVE-2026-64612 | High | 7.5 | 2026-07-20 | A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causi… |
CVE-2026-63747 | High | 7.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticate… |
CVE-2025-71391 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers… |
CVE-2024-58369 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Auth… |
CVE-2024-58368 | High | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated atta… |
CVE-2024-58365 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Auth… |
CVE-2024-58364 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator char… |
CVE-2024-58361 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authoriz… |
CVE-2024-58359 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can ex… |
CVE-2024-58358 | Medium | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexisten… |
CVE-2024-58357 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result fro… |
CVE-2026-62994 | Low | 3.7 | 2026-07-16 | CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDN… |
CVE-2026-48069 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-48068 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-48038 | Medium | 5.3 | 2026-07-14 | joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception i… |
CVE-2026-47480 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability… |
CVE-2026-50328 | High | 7.5 | 2026-07-14 | Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-59162 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv… |
CVE-2026-55780 | | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Ar… |
CVE-2026-54775 | Medium | 6.5 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka… |
CVE-2026-58208 | Medium | 6.8 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route… |
CVE-2026-59892 | High | 7.5 | 2026-07-08 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-*… |
CVE-2026-59875 | Medium | 5.3 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts… |
CVE-2026-27844 | Low | 2.7 | 2026-07-07 | Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a C… |
CVE-2026-27790 | Low | 2.7 | 2026-07-07 | Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in… |
CVE-2026-14631 | Medium | 5.3 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malfor… |
CVE-2026-54908 | | | 2026-07-01 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsi… |
CVE-2026-14181 | High | 7.5 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malform… |
CVE-2026-50129 | High | 7.5 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception… |
CVE-2026-55517 | Medium | 4.3 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remo… |
CVE-2026-12644 | Medium | 5.3 | 2026-06-19 | Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such… |
CVE-2026-46689 | | | 2026-06-10 | Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a… |
CVE-2026-46545 | High | 7.5 | 2026-06-10 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticat… |
CVE-2026-46411 | Medium | 6.5 | 2026-06-10 | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over… |
CVE-2026-45685 | High | 7.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed Mon… |
CVE-2026-45676 | Medium | 5.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trus… |
CVE-2026-45554 | Medium | 5.3 | 2026-06-02 | NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path paramet… |
CVE-2026-9509 | | | 2026-05-29 | An unhandled exception in Suprema BioStar 2 (Server), versions 2.9.8, 2.9.10, and 2.9.11, that allows an unauthenticated remote attacker to cause a denial of s… |
CVE-2025-15649 | Medium | 5.5 | 2026-05-27 | IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes th… |
CVE-2026-44905 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the crypto… |
CVE-2026-43988 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/… |
CVE-2026-44001 | High | 8.6 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.j… |
CVE-2026-42545 | Medium | 5.9 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP respo… |
CVE-2026-42544 | High | 7.5 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket up… |
CVE-2026-42268 | High | 7.5 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandl… |
CVE-2026-8161 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that… |
CVE-2026-41585 | Medium | 6.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnera… |
CVE-2026-37554 | High | 7.5 | 2026-05-01 | An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworkin… |
CVE-2026-7183 | Medium | 5.3 | 2026-04-27 | A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu… |
CVE-2026-5937 | Medium | 5.5 | 2026-04-27 | Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultim… |
CVE-2026-35348 | Medium | 5.5 | 2026-04-22 | The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The imple… |
CVE-2026-34944 | Medium | 5.7 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2… |
CVE-2026-34943 | High | 7.5 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed comp… |
CVE-2026-24175 | High | 7.5 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header to the server. A suc… |
CVE-2026-34986 | High | 7.5 | 2026-04-06 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… |
CVE-2026-34752 | High | 7.5 | 2026-04-02 | Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has be… |
CVE-2026-33939 | High | 7.5 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator s… |
CVE-2026-33203 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specifi… |
CVE-2026-33191 | High | 8.6 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2
are vulnerable to null byte injection… |
CVE-2026-32770 | Medium | 5.9 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker c… |
CVE-2026-32314 | High | 7.5 | 2026-03-16 | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a… |
CVE-2026-31949 | Medium | 6.5 | 2026-03-13 | LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint th… |
CVE-2026-2229 | High | 7.5 | 2026-03-12 | ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permess… |
CVE-2026-1528 | High | 7.5 | 2026-03-12 | ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends u… |
CVE-2026-31870 | High | 7.5 | 2026-03-11 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::s… |
CVE-2026-31812 | Medium | 5.3 | 2026-03-10 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a d… |
CVE-2026-20068 | Medium | 5.8 | 2026-03-04 | Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort… |
CVE-2026-20031 | Medium | 5.3 | 2026-03-04 | A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co… |
CVE-2026-27631 | Medium | 5.3 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaugh… |
CVE-2026-27819 | High | 7.2 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of th… |
CVE-2026-1507 | High | 7.5 | 2026-02-10 | The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a de… |
CVE-2026-25577 | High | 7.5 | 2026-02-10 | Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle… |
CVE-2025-24851 | Medium | 6.0 | 2026-02-10 | Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a den… |
CVE-2025-13064 | Medium | 4.5 | 2026-02-10 | A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This at… |
CVE-2026-25128 | High | 7.5 | 2026-01-30 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5… |
CVE-2025-59466 | High | 7.5 | 2026-01-20 | We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enable… |
CVE-2025-59465 | High | 7.5 | 2026-01-20 | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. I… |
CVE-2025-67647 | Critical | 9.1 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side req… |
CVE-2025-66578 | Medium | 6.0 | 2025-12-09 | xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Versions 3.1.3 contain an authentication bypass vulnerability due to a f… |
CVE-2025-20758 | Medium | 4.9 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20754 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20753 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-66305 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin… |
CVE-2025-0657 | | | 2025-11-27 | A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/T… |
CVE-2025-8870 | Medium | 4.9 | 2025-11-14 | On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 |
CVE-2025-12423 | High | 7.5 | 2025-10-28 | Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-59462 | Medium | 6.5 | 2025-10-27 | An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. |
CVE-2025-48430 | Medium | 5.5 | 2025-10-23 | Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.
This issue… |
CVE-2025-62370 | High | 7.5 | 2025-10-15 | Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::Ty… |