CVE-2026-102414 | Low | 3.7 | 2026-09-29 | pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer tha… |
CVE-2026-102278 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace g… |
CVE-2026-102277 | Medium | 5.3 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function h… |
CVE-2026-102276 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace pattern… |
CVE-2026-101911 | | | 2026-09-28 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and pa… |
CVE-2026-101906 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular ex… |
CVE-2026-101901 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a Client… |
CVE-2026-101098 | Medium | 4.3 | 2026-09-28 | A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHt… |
CVE-2026-94408 | Medium | 4.9 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94400 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94399 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94398 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94397 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94396 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-82300 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-82294 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-100662 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the Q… |
CVE-2026-100661 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-int… |
CVE-2026-100651 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a… |
CVE-2026-100650 | Medium | 6.5 | 2026-09-26 | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB c… |
CVE-2026-100648 | Medium | 5.3 | 2026-09-26 | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file si… |
CVE-2026-100572 | Medium | 5.3 | 2026-09-26 | OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw p… |
CVE-2026-100571 | Medium | 5.3 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and… |
CVE-2026-100558 | High | 7.5 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response so… |
CVE-2026-100542 | Low | 3.1 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffix… |
CVE-2026-100527 | Medium | 5.3 | 2026-09-26 | OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pendi… |
CVE-2026-56725 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check… |
CVE-2026-67415 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter val… |
CVE-2026-67408 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Priv… |
CVE-2026-67227 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resour… |
CVE-2026-67226 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 map… |
CVE-2026-67222 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimite… |
CVE-2026-66073 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. p… |
CVE-2026-66071 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope value… |
CVE-2026-53493 | | | 2026-09-25 | containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/me… |
CVE-2026-87722 | | | 2026-09-24 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate… |
CVE-2026-87721 | | | 2026-09-24 | Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through… |
CVE-2026-65827 | Medium | 6.5 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space… |
CVE-2026-61816 | High | 7.5 | 2026-09-24 | zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822… |
CVE-2026-96764 | Medium | 4.3 | 2026-09-24 | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component R… |
CVE-2026-59980 | | | 2026-09-23 | hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input le… |
CVE-2026-67229 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/… |
CVE-2026-67228 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an at… |
CVE-2026-67220 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, ad… |
CVE-2026-66072 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw… |
CVE-2026-67238 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded… |
CVE-2026-96541 | High | 7.5 | 2026-09-23 | A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and re… |
CVE-2026-61814 | High | 7.5 | 2026-09-23 | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunk… |
CVE-2026-6669 | Medium | 5.9 | 2026-09-23 | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicio… |
CVE-2026-77791 | High | 7.5 | 2026-09-23 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache T… |
CVE-2026-86608 | High | 8.2 | 2026-09-23 | The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, a… |
CVE-2026-14321 | High | 8.2 | 2026-09-23 | The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticat… |
CVE-2026-91777 | High | 7.5 | 2026-09-23 | Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for eve… |
CVE-2026-91776 | High | 7.5 | 2026-09-23 | TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-bas… |
CVE-2026-89425 | High | 7.5 | 2026-09-23 | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier char… |
CVE-2026-57576 | Medium | 6.5 | 2026-09-22 | plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types… |
CVE-2026-17465 | Medium | 6.5 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits. |
CVE-2026-77399 | Medium | 6.5 | 2026-09-22 | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled V… |
CVE-2026-75632 | High | 7.5 | 2026-09-22 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-83600 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes… |
CVE-2026-94640 | High | 7.5 | 2026-09-22 | A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of uniqu… |
CVE-2026-81880 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerabl… |
CVE-2026-89407 | High | 7.5 | 2026-09-22 | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[… |
CVE-2026-65115 | Medium | 6.5 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this… |
CVE-2026-65112 | Medium | 6.5 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of th… |
CVE-2026-94449 | High | 7.5 | 2026-09-21 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. T… |
CVE-2026-91867 | Medium | 4.3 | 2026-09-21 | When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fe… |
CVE-2026-63452 | High | 7.5 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser… |
CVE-2026-63448 | Medium | 5.9 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser… |
CVE-2026-57227 | High | 7.5 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQ… |
CVE-2026-57224 | Medium | 6.5 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser i… |
CVE-2026-69186 | Medium | 5.3 | 2026-09-18 | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confir… |
CVE-2026-33625 | High | 8.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `l… |
CVE-2026-93590 | Low | 3.7 | 2026-09-18 | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image p… |
CVE-2026-93587 | Low | 3.3 | 2026-09-18 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific com… |
CVE-2026-88798 | Medium | 5.3 | 2026-09-18 | The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own… |
CVE-2026-93310 | Medium | 5.3 | 2026-09-18 | A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocatio… |
CVE-2026-93309 | Medium | 4.3 | 2026-09-18 | A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a… |
CVE-2026-93308 | Medium | 4.3 | 2026-09-18 | A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing… |
CVE-2026-93307 | Medium | 4.3 | 2026-09-17 | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argumen… |
CVE-2026-68537 | High | 7.5 | 2026-09-17 | `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct c… |
CVE-2026-68523 | High | 7.5 | 2026-09-17 | `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct c… |
CVE-2026-50125 | High | 7.5 | 2026-09-17 | MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the… |
CVE-2026-86040 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0… |
CVE-2026-86000 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTI… |
CVE-2026-85999 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw select… |
CVE-2026-85721 | High | 7.5 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-85718 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12… |
CVE-2026-92942 | High | 7.5 | 2026-09-17 | vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout… |
CVE-2026-92879 | Medium | 4.3 | 2026-09-17 | A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation result… |
CVE-2026-92596 | High | 7.5 | 2026-09-16 | Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of servi… |
CVE-2026-81872 | | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight C… |
CVE-2026-81869 | | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enfor… |
CVE-2026-76646 | High | 7.5 | 2026-09-16 | A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service co… |
CVE-2026-81876 | High | 7.5 | 2026-09-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
CVE-2026-81875 | High | 7.5 | 2026-09-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-68904 | High | 7.0 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can… |
CVE-2026-79651 | High | 7.5 | 2026-09-16 | A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and the… |
CVE-2026-63128 | High | 7.5 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/stre… |