CWE-400 · Uncontrolled Resource Consumption (page 2)
Page 2 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63128 | High | 7.5 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/stre… |
CVE-2026-92363 | Medium | 4.3 | 2026-09-16 | A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executin… |
CVE-2026-92362 | High | 7.3 | 2026-09-16 | A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Fram… |
CVE-2026-92361 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go… |
CVE-2026-73175 | | 2026-09-16 | Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmwar… | |
CVE-2026-92356 | Medium | 4.3 | 2026-09-16 | A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component… |
CVE-2026-87828 | Medium | 5.7 | 2026-09-16 | The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated… |
CVE-2026-92220 | Medium | 5.3 | 2026-09-16 | A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_fini… |
CVE-2026-92114 | Medium | 5.3 | 2026-09-15 | A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functio… |
CVE-2026-61554 | High | 7.5 | 2026-09-15 | emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling s… |
CVE-2026-88975 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to bu… |
CVE-2026-87289 | High | 7.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0… |
CVE-2026-87285 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87283 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87282 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87279 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87277 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87274 | Medium | 4.4 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to… |
CVE-2026-87267 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to… |
CVE-2026-87222 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87215 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87199 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87148 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87138 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87126 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security). Supported versions that are affected are 12.2.3-1… |
CVE-2026-83480 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploita… |
CVE-2026-83465 | High | 8.2 | 2026-09-15 | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affecte… |
CVE-2026-83459 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-media-multipart). Supported versions that are affected are 3.0.0-3.2.20… |
CVE-2026-83458 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable v… |
CVE-2026-83457 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-83436 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Recall Management). Supported versions that are affected are 12.2.3-12… |
CVE-2026-83416 | Medium | 4.3 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0… |
CVE-2026-83369 | Low | 3.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-83350 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 21.3-21.23 and 23.4.0-23.26.3. Easily… |
CVE-2026-83349 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.2… |
CVE-2026-83347 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vuln… |
CVE-2026-83345 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easi… |
CVE-2026-83333 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vuln… |
CVE-2026-83330 | High | 7.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploita… |
CVE-2026-83281 | High | 7.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver). Supported versions that are affected are 4.0.0-4.5.4. Easily… |
CVE-2026-83280 | High | 7.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.4. E… |
CVE-2026-83276 | High | 7.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.4. E… |
CVE-2026-83251 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83248 | High | 8.2 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83228 | High | 7.5 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83225 | High | 7.5 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83222 | High | 7.5 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83183 | High | 7.5 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-76821 | | 2026-09-15 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWi… | |
CVE-2026-76702 | Medium | 5.8 | 2026-09-15 | A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service… |
CVE-2026-76700 | Medium | 5.9 | 2026-09-15 | Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitat… |
CVE-2026-76696 | Medium | 6.5 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successfu… |
CVE-2026-76693 | High | 7.0 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain servi… |
CVE-2026-76686 | High | 7.5 | 2026-09-15 | A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated… |
CVE-2026-76679 | High | 8.6 | 2026-09-15 | Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks. Successful… |
CVE-2026-73960 | High | 7.5 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). Supported versions that are affected are 8.61-8.6… |
CVE-2026-69203 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_… |
CVE-2026-69202 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received fr… |
CVE-2026-69213 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by… |
CVE-2026-69209 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragm… |
CVE-2026-69208 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the… |
CVE-2026-58483 | High | 7.5 | 2026-09-15 | mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read i… |
CVE-2026-53954 | Medium | 4.3 | 2026-09-15 | Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a calle… |
CVE-2026-11926 | High | 7.5 | 2026-09-15 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-21588 | | 2026-09-15 | This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0… | |
CVE-2026-91979 | Medium | 6.5 | 2026-09-15 | Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly… |
CVE-2026-91971 | Medium | 6.5 | 2026-09-15 | Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted image… |
CVE-2026-91969 | Medium | 6.5 | 2026-09-15 | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row car… |
CVE-2026-91941 | High | 7.5 | 2026-09-15 | Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial o… |
CVE-2026-48987 | Medium | 6.5 | 2026-09-15 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends… |
CVE-2026-92003 | | 2026-09-15 | Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote direc… | |
CVE-2026-90878 | Medium | 4.3 | 2026-09-15 | A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template… |
CVE-2026-12759 | Medium | 6.5 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-84553 | High | 7.5 | 2026-09-14 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A… |
CVE-2026-65410 | High | 7.5 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tv… |
CVE-2026-17463 | Medium | 6.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-53495 | | 2026-09-14 | containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely blo… | |
CVE-2026-90928 | Medium | 6.5 | 2026-09-14 | File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory withou… |
CVE-2026-90927 | Medium | 6.5 | 2026-09-14 | filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buff… |
CVE-2026-88932 | Medium | 5.3 | 2026-09-14 | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uplo… |
CVE-2026-90584 | Medium | 5.3 | 2026-09-13 | A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draf… |
CVE-2026-90582 | Medium | 5.3 | 2026-09-13 | A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo E… |
CVE-2026-90554 | Medium | 6.2 | 2026-09-12 | vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In na… |
CVE-2026-50018 | Medium | 6.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration… |
CVE-2026-54135 | High | 7.5 | 2026-09-11 | AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP serve… |
CVE-2026-71646 | High | 7.5 | 2026-09-11 | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the… |
CVE-2026-68497 | High | 7.5 | 2026-09-11 | jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to Da… |
CVE-2026-71641 | High | 7.5 | 2026-09-11 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via… |
CVE-2026-89147 | High | 7.5 | 2026-09-11 | Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without ti… |
CVE-2026-87908 | High | 7.5 | 2026-09-11 | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound… |
CVE-2026-71647 | High | 7.5 | 2026-09-10 | An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkColl… |
CVE-2026-71643 | High | 7.5 | 2026-09-10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via… |
CVE-2026-71642 | Medium | 4.0 | 2026-09-10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via… |
CVE-2026-45769 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2… |
CVE-2026-45768 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-45766 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certa… |
CVE-2026-45765 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3… |
CVE-2026-45759 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suric… |
CVE-2026-9338 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could expl… |
CVE-2026-87106 | Medium | 6.5 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory b… |