CWE-400 · Uncontrolled Resource Consumption (page 7)
Page 7 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34404 | High | 7.5 | 2026-03-31 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older version… |
CVE-2026-34043 | Medium | 5.9 | 2026-03-31 | Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerab… |
CVE-2026-33750 | Medium | 6.5 | 2026-03-27 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace patte… |
CVE-2026-28375 | Medium | 6.5 | 2026-03-27 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27879 | Medium | 6.5 | 2026-03-27 | A resample query can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-33623 | Medium | 6.7 | 2026-03-26 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection iss… |
CVE-2026-33541 | Medium | 6.5 | 2026-03-26 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2026-33375 | Medium | 6.5 | 2026-03-26 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out… |
CVE-2026-4926 | High | 7.5 | 2026-03-26 | Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated… |
CVE-2026-3116 | Medium | 4.9 | 2026-03-26 | Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause servi… |
CVE-2026-33287 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaS… |
CVE-2026-33285 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can b… |
CVE-2026-26233 | Medium | 4.3 | 2026-03-25 | Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated re… |
CVE-2026-20084 | High | 8.6 | 2026-03-25 | A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded be… |
CVE-2026-33268 | Medium | 6.5 | 2026-03-25 | Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume stora… |
CVE-2026-28874 | High | 7.5 | 2026-03-25 | The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination. |
CVE-2026-33538 | High | 7.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthe… |
CVE-2026-33474 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing… |
CVE-2026-30662 | Medium | 6.5 | 2026-03-24 | ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file… |
CVE-2026-30653 | High | 7.5 | 2026-03-24 | An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF |
CVE-2026-4727 | High | 7.5 | 2026-03-24 | Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4726 | High | 7.5 | 2026-03-24 | Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4704 | High | 7.5 | 2026-03-24 | Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-33176 | High | 7.5 | 2026-03-24 | Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1… |
CVE-2026-33169 | Medium | 5.3 | 2026-03-24 | Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-bas… |
CVE-2026-4539 | Low | 3.3 | 2026-03-22 | A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manip… |
CVE-2026-33204 | High | 7.5 | 2026-03-20 | SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header… |
CVE-2026-33155 | High | 7.5 | 2026-03-20 | DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6.2, the pickle unpickler _RestrictedUnp… |
CVE-2026-33123 | Medium | 6.5 | 2026-03-20 | pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or… |
CVE-2026-25667 | High | 7.5 | 2026-03-19 | ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a cr… |
CVE-2026-29856 | High | 7.5 | 2026-03-18 | An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS)… |
CVE-2026-27980 | High | 7.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimi… |
CVE-2026-25771 | Medium | 5.3 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial o… |
CVE-2025-68971 | Medium | 6.5 | 2026-03-16 | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an is… |
CVE-2026-30405 | High | 7.5 | 2026-03-16 | An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute |
CVE-2025-52636 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resou… |
CVE-2026-4174 | Low | 3.3 | 2026-03-16 | A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component M… |
CVE-2026-30955 | Medium | 6.5 | 2026-03-13 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies… |
CVE-2026-29776 | Low | 3.1 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Cor… |
CVE-2026-25819 | High | 7.5 | 2026-03-13 | HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticate… |
CVE-2026-23940 | Medium | 6.5 | 2026-03-13 | Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out o… |
CVE-2026-31958 | High | 7.5 | 2026-03-11 | Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipar… |
CVE-2026-30980 | Medium | 5.5 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFact… |
CVE-2025-70047 | High | 7.5 | 2026-03-09 | An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in Nexusoft NexusInterface v3.2.0-beta.2. |
CVE-2025-70059 | High | 7.5 | 2026-03-09 | An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service. |
CVE-2025-69654 | High | 7.5 | 2026-03-06 | A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interprete… |
CVE-2025-69646 | Medium | 5.5 | 2026-03-06 | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the han… |
CVE-2025-69645 | Medium | 5.5 | 2026-03-06 | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handl… |
CVE-2025-69644 | Medium | 5.0 | 2026-03-06 | An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug i… |
CVE-2026-26018 | High | 7.5 | 2026-03-06 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows a… |
CVE-2026-29049 | Medium | 4.3 | 2026-03-06 | melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via… |
CVE-2026-28789 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists… |
CVE-2026-28342 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users… |
CVE-2026-26999 | High | 7.5 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake o… |
CVE-2025-69534 | High | 7.5 | 2026-03-05 | Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError d… |
CVE-2026-1605 | High | 7.5 | 2026-03-05 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: g… |
CVE-2026-28435 | High | 7.5 | 2026-03-04 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload… |
CVE-2026-20066 | Medium | 5.8 | 2026-03-04 | Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort… |
CVE-2026-23809 | Medium | 5.4 | 2026-03-04 | A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between… |
CVE-2026-26673 | High | 7.5 | 2026-03-04 | An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-Wi… |
CVE-2026-25673 | High | 7.5 | 2026-03-03 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which… |
CVE-2025-48609 | Critical | 9.1 | 2026-03-02 | In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a pa… |
CVE-2026-28412 | Medium | 6.5 | 2026-03-02 | Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined w… |
CVE-2026-28351 | Medium | 5.3 | 2026-02-27 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large m… |
CVE-2026-21619 | High | 7.5 | 2026-02-27 | Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang… |
CVE-2026-3293 | Low | 3.3 | 2026-02-27 | A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake… |
CVE-2026-26937 | Medium | 6.5 | 2026-02-26 | Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) |
CVE-2026-27888 | High | 7.5 | 2026-02-26 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being e… |
CVE-2026-27633 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhau… |
CVE-2026-27630 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as S… |
CVE-2026-27204 | Medium | 6.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susc… |
CVE-2025-67445 | High | 7.5 | 2026-02-24 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variab… |
CVE-2026-26066 | Medium | 6.2 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile cont… |
CVE-2026-24485 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does n… |
CVE-2026-24484 | Medium | 5.3 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check… |
CVE-2025-70327 | Critical | 9.8 | 2026-02-23 | TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The i… |
CVE-2026-27576 | Medium | 4.0 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt pa… |
CVE-2026-26047 | Medium | 6.5 | 2026-02-21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits c… |
CVE-2026-25535 | High | 7.5 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If… |
CVE-2019-25401 | High | 7.5 | 2026-02-18 | Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a denial of service vulnerability in the admin configuration page. Remote attackers c… |
CVE-2026-20139 | Medium | 4.3 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, a… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2025-66676 | Medium | 6.2 | 2026-02-13 | An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request. |
CVE-2026-25949 | High | 7.5 | 2026-02-12 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticate… |
CVE-2026-21435 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing… |
CVE-2025-70886 | High | 7.5 | 2026-02-12 | An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint |
CVE-2026-20676 | Medium | 5.3 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A we… |
CVE-2026-20652 | High | 7.5 | 2026-02-11 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe… |
CVE-2026-20650 | High | 7.5 | 2026-02-11 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3… |
CVE-2026-20602 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be abl… |
CVE-2025-46304 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-69873 | Low | 2.9 | 2026-02-11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern k… |
CVE-2025-62854 | Medium | 6.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-54151 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54150 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54149 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-70347 | Medium | 5.5 | 2026-02-10 | An issue in mquickjs before commit 74b7e (2026-01-15) allows a local attacker to cause a denial of service via a crafted file to the get_mblock_size function a… |