CVE-2026-109338 | Medium | 6.5 | 2026-10-12 | SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in emb… |
CVE-2026-109301 | Medium | 5.9 | 2026-10-12 | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and Liv… |
CVE-2026-107392 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore… |
CVE-2026-107382 | Medium | 5.9 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration T… |
CVE-2026-107214 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient str… |
CVE-2026-78243 | | | 2026-10-07 | Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LD… |
CVE-2026-96399 | High | 7.5 | 2026-10-06 | A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue re… |
CVE-2026-102413 | Medium | 6.2 | 2026-10-06 | Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint compon… |
CVE-2026-106122 | High | 7.5 | 2026-10-06 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShorts… |
CVE-2026-105757 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and… |
CVE-2026-105756 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value withou… |
CVE-2026-58859 | High | 7.8 | 2026-10-05 | In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional ex… |
CVE-2026-96286 | | | 2026-10-02 | Uncaught exception vulnerability in Apache Thrift Perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to ver… |
CVE-2026-96277 | | | 2026-10-02 | Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings.
This issue affects Apache Thrift: before 0.25… |
CVE-2026-96294 | | | 2026-10-02 | Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings.
This issue affects Apache Thrift: before 0.2… |
CVE-2026-94646 | | | 2026-10-02 | Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution… |
CVE-2026-90440 | | | 2026-10-02 | Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonbloc… |
CVE-2026-86537 | | | 2026-10-02 | Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bi… |
CVE-2026-94642 | | | 2026-10-02 | Uncaught exception vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to vers… |
CVE-2026-85494 | High | 7.5 | 2026-10-02 | Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initi… |
CVE-2026-85493 | | | 2026-10-02 | Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended t… |
CVE-2026-94639 | | | 2026-10-02 | improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindi… |
CVE-2026-103387 | Medium | 4.3 | 2026-09-30 | A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto H… |
CVE-2026-102984 | | | 2026-09-30 | Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed por… |
CVE-2026-102511 | | | 2026-09-30 | Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to se… |
CVE-2026-96274 | High | 7.4 | 2026-09-29 | In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS pa… |
CVE-2026-102281 | High | 7.5 | 2026-09-28 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pat… |
CVE-2026-101918 | Medium | 5.3 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload… |
CVE-2026-101101 | Medium | 4.3 | 2026-09-28 | A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the compon… |
CVE-2026-101035 | Medium | 5.3 | 2026-09-28 | A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component n… |
CVE-2026-100722 | Medium | 6.8 | 2026-09-27 | vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromi… |
CVE-2026-100675 | Medium | 6.5 | 2026-09-26 | stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated us… |
CVE-2026-92608 | High | 7.5 | 2026-09-25 | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQ… |
CVE-2026-92905 | Medium | 5.3 | 2026-09-24 | ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector… |
CVE-2026-95842 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart… |
CVE-2026-62985 | High | 7.5 | 2026-09-22 | request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and… |
CVE-2026-94622 | High | 7.5 | 2026-09-21 | vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments… |
CVE-2026-88411 | High | 7.5 | 2026-09-21 | Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within t… |
CVE-2026-32641 | High | 7.5 | 2026-09-18 | Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while pa… |
CVE-2026-92954 | High | 8.6 | 2026-09-17 | vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandb… |
CVE-2026-82410 | | | 2026-09-16 | Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but… |
CVE-2026-92081 | Medium | 5.9 | 2026-09-16 | fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is s… |
CVE-2026-61544 | | | 2026-09-15 | libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handsh… |
CVE-2026-65410 | High | 7.5 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tv… |
CVE-2026-55244 | Medium | 5.0 | 2026-09-14 | ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterru… |
CVE-2026-84445 | | | 2026-09-14 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.g… |
CVE-2026-53496 | Medium | 5.3 | 2026-09-14 | ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEI… |
CVE-2026-54541 | Low | 3.7 | 2026-09-14 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can… |
CVE-2026-54529 | Medium | 5.3 | 2026-09-14 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortB… |
CVE-2026-89090 | Medium | 5.9 | 2026-09-11 | An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to te… |
CVE-2026-87123 | Medium | 5.9 | 2026-09-11 | hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with… |
CVE-2026-88015 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or li… |
CVE-2026-69839 | Medium | 6.5 | 2026-09-08 | Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network. |
CVE-2026-82058 | Medium | 6.5 | 2026-09-08 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON… |
CVE-2022-51014 | Medium | 6.5 | 2026-09-07 | PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. At… |
CVE-2022-51009 | High | 7.5 | 2026-09-06 | PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login… |
CVE-2026-19534 | High | 7.5 | 2026-09-04 | undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never reques… |
CVE-2026-85024 | Medium | 5.9 | 2026-09-04 | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error… |
CVE-2026-85014 | Medium | 5.9 | 2026-09-04 | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake… |
CVE-2026-84947 | Low | 3.7 | 2026-09-04 | undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maxi… |
CVE-2026-72644 | Medium | 6.5 | 2026-09-01 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-priv… |
CVE-2026-82417 | Medium | 5.3 | 2026-08-30 | ### Summary
`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member… |
CVE-2026-81517 | High | 7.5 | 2026-08-28 | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhau… |
CVE-2026-77078 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an un… |
CVE-2026-55484 | High | 7.5 | 2026-08-28 | ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/uti… |
CVE-2026-82254 | High | 7.5 | 2026-08-28 | gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attack… |
CVE-2026-54553 | Medium | 5.4 | 2026-08-26 | Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API do… |
CVE-2026-63403 | | | 2026-08-25 | Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a… |
CVE-2026-79778 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transp… |
CVE-2026-77781 | High | 7.5 | 2026-08-22 | Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.
The FETCH, EXISTS and DELETE methods throw an exception wh… |
CVE-2026-53530 | | | 2026-08-21 | RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on… |
CVE-2026-52739 | Medium | 5.9 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a n… |
CVE-2026-52738 | | | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can p… |
CVE-2026-52731 | Medium | 6.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a… |
CVE-2026-23938 | Medium | 4.9 | 2026-08-18 | An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading t… |
CVE-2026-61666 | | | 2026-08-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in… |
CVE-2026-72813 | | | 2026-08-14 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to… |
CVE-2026-72660 | Medium | 6.5 | 2026-08-13 | Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153… |
CVE-2026-49096 | Medium | 4.3 | 2026-08-13 | Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comm… |
CVE-2026-73418 | High | 7.5 | 2026-08-12 | NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next… |
CVE-2026-18675 | | | 2026-08-12 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |
CVE-2026-20775 | Medium | 5.3 | 2026-08-11 | Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user co… |
CVE-2026-52856 | High | 7.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SF… |
CVE-2026-65834 | Medium | 6.8 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and Capsule… |
CVE-2026-13697 | High | 7.4 | 2026-07-29 | undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response… |
CVE-2026-47219 | High | 7.5 | 2026-07-28 | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are v… |
CVE-2026-64612 | High | 7.5 | 2026-07-20 | A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causi… |
CVE-2026-63747 | High | 7.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticate… |
CVE-2025-71391 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers… |
CVE-2024-58369 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Auth… |
CVE-2024-58368 | High | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated atta… |
CVE-2024-58365 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Auth… |
CVE-2024-58364 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator char… |
CVE-2024-58361 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authoriz… |
CVE-2024-58359 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can ex… |
CVE-2024-58358 | Medium | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexisten… |
CVE-2024-58357 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result fro… |
CVE-2026-62994 | Low | 3.7 | 2026-07-16 | CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDN… |
CVE-2026-48069 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |