CVE-2026-16251 | Medium | 6.5 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memor… |
CVE-2026-19867 | Medium | 4.3 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user'… |
CVE-2026-111384 | Medium | 6.5 | 2026-10-16 | Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit… |
CVE-2026-111383 | Medium | 6.5 | 2026-10-16 | Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /a… |
CVE-2026-109468 | High | 7.5 | 2026-10-15 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-109932 | Medium | 5.9 | 2026-10-15 | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, includin… |
CVE-2026-109924 | Medium | 5.9 | 2026-10-15 | undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be d… |
CVE-2026-104827 | High | 7.5 | 2026-10-15 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStre… |
CVE-2026-77468 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/sc… |
CVE-2026-77467 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pr… |
CVE-2026-100350 | Medium | 5.3 | 2026-10-15 | kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-n… |
CVE-2026-110927 | Medium | 4.3 | 2026-10-15 | A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop d… |
CVE-2026-110726 | Medium | 6.5 | 2026-10-15 | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element… |
CVE-2026-102464 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every i… |
CVE-2026-102475 | | | 2026-10-15 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffe… |
CVE-2026-102467 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number… |
CVE-2026-102465 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a… |
CVE-2026-110843 | | | 2026-10-14 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which r… |
CVE-2026-102682 | Medium | 5.6 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's… |
CVE-2026-109527 | High | 7.5 | 2026-10-14 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1… |
CVE-2026-108395 | High | 7.5 | 2026-10-14 | The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelc… |
CVE-2026-102048 | Medium | 6.5 | 2026-10-14 | An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated atta… |
CVE-2026-101971 | Medium | 6.5 | 2026-10-14 | An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved pl… |
CVE-2026-86561 | Medium | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or mem… |
CVE-2026-67414 | | | 2026-10-14 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes… |
CVE-2026-101896 | | | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24… |
CVE-2026-73273 | Medium | 4.3 | 2026-10-14 | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-p… |
CVE-2026-110595 | Medium | 4.3 | 2026-10-14 | BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 M… |
CVE-2026-110591 | Medium | 5.5 | 2026-10-14 | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via cr… |
CVE-2026-110262 | Low | 3.3 | 2026-10-14 | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by suppl… |
CVE-2026-88084 | Medium | 5.3 | 2026-10-13 | Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. |
CVE-2026-96959 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-96300 | Medium | 5.9 | 2026-10-13 | Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network. |
CVE-2026-96236 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-85321 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
CVE-2026-85319 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
CVE-2026-83645 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a net… |
CVE-2026-70181 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-70163 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. |
CVE-2026-70159 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-70133 | High | 7.5 | 2026-10-13 | Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
CVE-2026-70072 | Medium | 6.5 | 2026-10-13 | Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network. |
CVE-2026-54086 | Medium | 5.3 | 2026-10-13 | SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body le… |
CVE-2026-104817 | | | 2026-10-13 | Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-si… |
CVE-2026-95502 | Medium | 5.3 | 2026-10-13 | A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (un… |
CVE-2026-33374 | Medium | 6.5 | 2026-10-13 | The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations th… |
CVE-2026-12656 | | | 2026-10-13 | A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which… |
CVE-2026-109947 | Medium | 6.5 | 2026-10-13 | FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via ove… |
CVE-2026-41510 | High | 7.2 | 2026-10-12 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgument… |
CVE-2026-105466 | Medium | 6.5 | 2026-10-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific condi… |
CVE-2026-109351 | Medium | 6.5 | 2026-10-12 | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge… |
CVE-2026-109339 | Medium | 4.9 | 2026-10-12 | SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing… |
CVE-2026-109310 | Medium | 6.5 | 2026-10-12 | SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion… |
CVE-2026-96618 | | | 2026-10-12 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk sp… |
CVE-2026-109228 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps… |
CVE-2026-109227 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution bef… |
CVE-2026-109225 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversiz… |
CVE-2026-109205 | High | 7.5 | 2026-10-12 | LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files… |
CVE-2026-108768 | Medium | 4.3 | 2026-10-11 | A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argumen… |
CVE-2026-108859 | High | 7.5 | 2026-10-11 | mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memor… |
CVE-2026-108755 | Medium | 5.3 | 2026-10-11 | Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS in… |
CVE-2026-108714 | High | 7.5 | 2026-10-11 | MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application… |
CVE-2026-107843 | Medium | 5.3 | 2026-10-09 | Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to… |
CVE-2026-102554 | | | 2026-10-09 | Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacke… |
CVE-2026-107937 | High | 7.5 | 2026-10-09 | In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) a… |
CVE-2026-87110 | Medium | 5.3 | 2026-10-09 | An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limit… |
CVE-2026-107885 | Low | 3.3 | 2026-10-09 | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses… |
CVE-2026-94440 | High | 7.5 | 2026-10-08 | Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 40… |
CVE-2026-78667 | High | 7.5 | 2026-10-08 | When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. |
CVE-2026-78399 | Medium | 6.5 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of serv… |
CVE-2026-107386 | | | 2026-10-08 | amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection… |
CVE-2026-107379 | Medium | 6.5 | 2026-10-08 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhit… |
CVE-2026-107586 | Medium | 4.3 | 2026-10-08 | Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to… |
CVE-2026-107585 | Medium | 5.3 | 2026-10-08 | Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker t… |
CVE-2026-16176 | High | 7.5 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacke… |
CVE-2026-1403 | Medium | 6.5 | 2026-10-07 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing… |
CVE-2026-107212 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number abov… |
CVE-2026-20173 | Medium | 5.8 | 2026-10-07 | A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) conditio… |
CVE-2026-107166 | Medium | 5.3 | 2026-10-07 | A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the… |
CVE-2026-106569 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the… |
CVE-2026-80048 | Medium | 5.5 | 2026-10-07 | A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large reques… |
CVE-2026-104046 | Medium | 6.2 | 2026-10-06 | A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in… |
CVE-2026-106450 | Medium | 5.3 | 2026-10-06 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers when… |
CVE-2026-102411 | Medium | 6.5 | 2026-10-06 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsear… |
CVE-2025-8352 | | | 2026-10-06 | Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions… |
CVE-2026-39767 | Medium | 6.5 | 2026-10-06 | Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions. |
CVE-2026-104041 | Medium | 5.5 | 2026-10-06 | A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Be… |
CVE-2026-105758 | Medium | 5.3 | 2026-10-05 | vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept req… |
CVE-2026-105747 | Medium | 4.3 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-… |
CVE-2026-94201 | | | 2026-10-05 | Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced th… |
CVE-2026-105686 | | | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither re… |
CVE-2026-104713 | Medium | 6.5 | 2026-10-05 | Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on ho… |
CVE-2026-104893 | Medium | 5.4 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while P… |
CVE-2026-105127 | Medium | 5.3 | 2026-10-04 | LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and p… |
CVE-2026-97873 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation w… |
CVE-2026-104845 | High | 7.5 | 2026-10-02 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSO… |
CVE-2026-94657 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
This issue affects Apache Thrift: before 0.25.0.
Use… |
CVE-2026-94656 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-94655 | | | 2026-10-02 | Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apa… |
CVE-2026-83632 | | | 2026-10-02 | Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue… |