CVE-2026-111378 | High | 7.5 | 2026-10-16 | FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exh… |
CVE-2026-111377 | Medium | 6.5 | 2026-10-16 | FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Auth… |
CVE-2026-111252 | Medium | 6.5 | 2026-10-15 | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit… |
CVE-2026-109932 | Medium | 5.9 | 2026-10-15 | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, includin… |
CVE-2026-104150 | | | 2026-10-15 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.mat… |
CVE-2026-77467 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pr… |
CVE-2026-100350 | Medium | 5.3 | 2026-10-15 | kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-n… |
CVE-2026-102462 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssq… |
CVE-2026-110872 | Medium | 5.9 | 2026-10-14 | Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData… |
CVE-2026-110871 | Medium | 6.5 | 2026-10-14 | Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadrati… |
CVE-2026-110833 | Medium | 5.9 | 2026-10-14 | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers ca… |
CVE-2026-110832 | Medium | 6.5 | 2026-10-14 | FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers t… |
CVE-2026-110830 | Medium | 5.9 | 2026-10-14 | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers… |
CVE-2026-107349 | High | 7.5 | 2026-10-14 | An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options para… |
CVE-2026-59951 | | | 2026-10-14 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable… |
CVE-2026-105659 | | | 2026-10-14 | Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a t… |
CVE-2026-67414 | | | 2026-10-14 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes… |
CVE-2026-101896 | | | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24… |
CVE-2026-73130 | Medium | 4.3 | 2026-10-14 | Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into temp… |
CVE-2026-63021 | Medium | 6.5 | 2026-10-14 | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory… |
CVE-2026-62925 | Medium | 6.5 | 2026-10-14 | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry… |
CVE-2026-60021 | | | 2026-10-14 | Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenti… |
CVE-2026-60018 | Medium | 6.5 | 2026-10-14 | Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authentic… |
CVE-2026-107381 | Medium | 6.5 | 2026-10-14 | svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference gra… |
CVE-2026-101895 | | | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23… |
CVE-2026-106627 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-105902 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100139 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100138 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100137 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-95696 | Medium | 6.5 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. |
CVE-2026-75996 | High | 7.5 | 2026-10-13 | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this v… |
CVE-2026-67626 | Medium | 6.5 | 2026-10-13 | Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network. |
CVE-2026-97811 | High | 7.8 | 2026-10-13 | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
CVE-2026-97775 | High | 8.8 | 2026-10-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-33374 | Medium | 6.5 | 2026-10-13 | The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations th… |
CVE-2026-103499 | High | 7.5 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenti… |
CVE-2026-109781 | Medium | 6.5 | 2026-10-13 | Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109775 | Medium | 6.5 | 2026-10-13 | Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109773 | Medium | 6.5 | 2026-10-13 | Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109768 | Medium | 6.5 | 2026-10-13 | Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109149 | Medium | 5.3 | 2026-10-13 | A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to… |
CVE-2026-109144 | Medium | 5.3 | 2026-10-13 | A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such… |
CVE-2026-75095 | High | 7.5 | 2026-10-12 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-90911 | High | 7.5 | 2026-10-12 | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-75881 | High | 7.5 | 2026-10-12 | IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop… |
CVE-2026-95838 | | | 2026-10-12 | containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories f… |
CVE-2026-83536 | Medium | 5.3 | 2026-10-12 | A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeou… |
CVE-2026-109299 | Medium | 6.5 | 2026-10-12 | Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instanc… |
CVE-2026-109298 | Medium | 6.5 | 2026-10-12 | Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted… |
CVE-2026-109297 | Medium | 6.5 | 2026-10-12 | Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses… |
CVE-2026-109294 | Medium | 6.5 | 2026-10-12 | Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by su… |
CVE-2026-108768 | Medium | 4.3 | 2026-10-11 | A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argumen… |
CVE-2026-108683 | Medium | 4.3 | 2026-10-11 | A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handle… |
CVE-2026-108577 | Medium | 4.3 | 2026-10-11 | A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of… |
CVE-2026-14854 | High | 7.5 | 2026-10-11 | The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated A… |
CVE-2026-108545 | Medium | 5.9 | 2026-10-10 | SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-pa… |
CVE-2026-75350 | High | 7.5 | 2026-10-09 | EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List se… |
CVE-2026-107840 | High | 7.5 | 2026-10-09 | yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses… |
CVE-2026-107839 | High | 7.5 | 2026-10-09 | ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1… |
CVE-2026-107834 | Medium | 5.3 | 2026-10-09 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/mul… |
CVE-2026-75347 | High | 7.5 | 2026-10-09 | EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) ha… |
CVE-2026-48484 | Medium | 6.5 | 2026-10-09 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/f… |
CVE-2026-75349 | High | 7.5 | 2026-10-09 | EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remot… |
CVE-2026-75345 | High | 7.5 | 2026-10-09 | OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of se… |
CVE-2026-107805 | High | 7.5 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an… |
CVE-2026-86463 | High | 7.5 | 2026-10-09 | Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinat… |
CVE-2026-107727 | Low | 3.7 | 2026-10-08 | Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/p… |
CVE-2026-95116 | High | 7.5 | 2026-10-08 | An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c. |
CVE-2026-107392 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore… |
CVE-2026-107391 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regressi… |
CVE-2026-95209 | High | 7.5 | 2026-10-08 | An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). |
CVE-2026-84276 | High | 7.5 | 2026-10-08 | IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network ac… |
CVE-2026-95184 | High | 7.5 | 2026-10-08 | Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS… |
CVE-2026-61801 | Medium | 5.5 | 2026-10-08 | The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0… |
CVE-2026-107294 | Medium | 6.5 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the W… |
CVE-2026-107287 | Medium | 6.5 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_t… |
CVE-2026-14509 | Medium | 5.9 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacke… |
CVE-2026-105830 | High | 7.5 | 2026-10-08 | league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableSta… |
CVE-2026-16169 | High | 7.5 | 2026-10-08 | IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-107227 | High | 7.5 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14… |
CVE-2026-97717 | | | 2026-10-07 | CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access servers prior to
14.60. Authenticated attackers can send malformed data to the serve… |
CVE-2026-97716 | | | 2026-10-07 | CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure Access servers
prior to version 14.60. Unauthenticated attackers can send speci… |
CVE-2026-97715 | | | 2026-10-07 | CVE-2026-97715 is
a vulnerability in the client registration process of Secure Access servers
prior to version 14.60. Authenticated attackers can pass malforme… |
CVE-2026-97714 | | | 2026-10-07 | CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secure Access
servers prior to version 14.60. Attackers can send a malformed respons… |
CVE-2026-107219 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled s… |
CVE-2026-107208 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach… |
CVE-2026-107166 | Medium | 5.3 | 2026-10-07 | A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the… |
CVE-2026-106580 | Medium | 4.0 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check… |
CVE-2026-106576 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive w… |
CVE-2026-106573 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MV… |
CVE-2026-106570 | Medium | 4.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client ca… |
CVE-2026-106565 | Medium | 5.9 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check whi… |
CVE-2026-84897 | Medium | 5.3 | 2026-10-07 | src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KE… |
CVE-2026-93679 | Medium | 4.3 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during… |
CVE-2026-104633 | Medium | 6.5 | 2026-10-06 | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads… |
CVE-2026-106550 | High | 7.5 | 2026-10-06 | Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in con… |
CVE-2026-96580 | High | 7.5 | 2026-10-06 | Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request app… |
CVE-2026-79812 | Medium | 6.1 | 2026-10-06 | A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated… |
CVE-2026-102404 | Medium | 6.5 | 2026-10-06 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated… |