CVE-2026-105127 | Medium | 5.3 | 2026-10-04 | LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and p… |
CVE-2026-97873 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation w… |
CVE-2026-104845 | High | 7.5 | 2026-10-02 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSO… |
CVE-2026-94657 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
This issue affects Apache Thrift: before 0.25.0.
Use… |
CVE-2026-94656 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-94655 | | | 2026-10-02 | Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apa… |
CVE-2026-83632 | | | 2026-10-02 | Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue… |
CVE-2026-66331 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: be… |
CVE-2026-66055 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.
This issue affects Ap… |
CVE-2026-66054 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindi… |
CVE-2026-63772 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users a… |
CVE-2026-61374 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-96288 | | | 2026-10-02 | Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrif… |
CVE-2026-94648 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-94638 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-82458 | | | 2026-10-02 | Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, Jav… |
CVE-2026-61373 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0… |
CVE-2026-104436 | Low | 3.7 | 2026-10-02 | Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversiz… |
CVE-2026-104429 | Medium | 5.3 | 2026-10-02 | Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are… |
CVE-2026-96990 | | | 2026-10-02 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrift: before 0.25.0.
Use… |
CVE-2026-94645 | | | 2026-10-02 | Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
Thi… |
CVE-2026-94644 | | | 2026-10-02 | Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users… |
CVE-2026-91137 | | | 2026-10-02 | Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PH… |
CVE-2026-94639 | | | 2026-10-02 | improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindi… |
CVE-2026-94635 | | | 2026-10-02 | Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This… |
CVE-2026-94634 | | | 2026-10-02 | Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings.
… |
CVE-2026-63578 | | | 2026-10-02 | Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-… |
CVE-2026-63572 | | | 2026-10-02 | Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an atta… |
CVE-2026-17508 | | | 2026-10-02 | In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being… |
CVE-2026-63568 | | | 2026-10-02 | Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp b… |
CVE-2026-103761 | High | 7.5 | 2026-10-01 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated att… |
CVE-2026-68496 | High | 7.5 | 2026-10-01 | The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so… |
CVE-2026-68495 | High | 7.5 | 2026-10-01 | The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so t… |
CVE-2023-54404 | High | 7.5 | 2026-10-01 | Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a… |
CVE-2026-94250 | | | 2026-10-01 | Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX.
An unauthenticated caller can drive a gateway… |
CVE-2026-103261 | Medium | 5.3 | 2026-10-01 | Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by… |
CVE-2026-102993 | High | 7.5 | 2026-09-30 | pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_p… |
CVE-2026-101881 | Medium | 6.5 | 2026-09-30 | OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected… |
CVE-2026-103472 | High | 7.5 | 2026-09-30 | restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded strea… |
CVE-2026-103471 | High | 7.5 | 2026-09-30 | restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory… |
CVE-2026-100274 | Medium | 6.5 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
CVE-2026-94681 | Medium | 5.9 | 2026-09-30 | Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. |
CVE-2026-100508 | Medium | 5.3 | 2026-09-30 | Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
CVE-2026-76992 | High | 7.5 | 2026-09-30 | The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote… |
CVE-2026-94029 | Medium | 6.5 | 2026-09-30 | Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-hand… |
CVE-2026-94002 | High | 7.5 | 2026-09-30 | Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
… |
CVE-2026-93996 | Medium | 6.5 | 2026-09-30 | Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library fo… |
CVE-2026-102509 | | | 2026-09-30 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC… |
CVE-2026-103102 | High | 8.6 | 2026-09-30 | Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort… |
CVE-2026-103101 | High | 8.6 | 2026-09-30 | Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infi… |
CVE-2026-86104 | | | 2026-09-30 | An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of se… |
CVE-2026-18105 | | | 2026-09-30 | An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of s… |
CVE-2026-103042 | High | 7.5 | 2026-09-29 | LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated… |
CVE-2026-102821 | Medium | 6.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INI… |
CVE-2026-102713 | | | 2026-09-29 | The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than
four bytes (nxd_tftp_server.c:1037) and nothing anywhere… |
CVE-2026-97689 | | | 2026-09-29 | urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded mem… |
CVE-2026-84784 | High | 7.5 | 2026-09-29 | Issue summary: A malicious remote peer may flood the local QUIC
stack with NEW_CONNECTION_ID frames by avoiding a limit check on
how many connection IDs the re… |
CVE-2026-75804 | Medium | 5.3 | 2026-09-29 | Issue summary: OpenSSL QUIC stack does not enforce connection
level flow control for streams. Remote peers may send more bytes
as long as they fit within the s… |
CVE-2026-54873 | High | 7.5 | 2026-09-29 | Issue summary: QUIC process may keep memory for QUIC packet
buffer for much longer period than necessary.
Impact summary: Remote peer can exploit this vulnera… |
CVE-2026-35189 | Medium | 5.3 | 2026-09-29 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
distribution points causes disproportionate heap growth when OpenSSL caches
X.509 extensions… |
CVE-2026-100826 | Medium | 6.5 | 2026-09-29 | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox… |
CVE-2026-100812 | Medium | 6.5 | 2026-09-29 | Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100795 | Medium | 6.5 | 2026-09-29 | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-101917 | Medium | 5.3 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refr… |
CVE-2026-101911 | | | 2026-09-28 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and pa… |
CVE-2026-101333 | Low | 3.7 | 2026-09-28 | A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the… |
CVE-2026-82936 | | | 2026-09-28 | mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB… |
CVE-2026-92103 | | | 2026-09-28 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16… |
CVE-2026-91043 | | | 2026-09-28 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host an… |
CVE-2026-100660 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a… |
CVE-2026-100649 | Low | 3.7 | 2026-09-26 | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent coun… |
CVE-2026-100600 | Medium | 5.3 | 2026-09-26 | ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests… |
CVE-2026-67230 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_… |
CVE-2026-67225 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated du… |
CVE-2026-92560 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-53493 | | | 2026-09-25 | containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/me… |
CVE-2026-65827 | Medium | 6.5 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space… |
CVE-2026-71540 | High | 7.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd… |
CVE-2026-94613 | High | 7.5 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an… |
CVE-2026-88382 | High | 7.5 | 2026-09-24 | hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. |
CVE-2026-88359 | Medium | 6.5 | 2026-09-24 | libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large li… |
CVE-2026-96764 | Medium | 4.3 | 2026-09-24 | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component R… |
CVE-2026-67235 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored wi… |
CVE-2026-67219 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_binding/3 parses the routing key as an integer w… |
CVE-2026-66080 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is… |
CVE-2026-66067 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost… |
CVE-2026-86065 | High | 7.5 | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes… |
CVE-2026-66079 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) return… |
CVE-2026-92284 | | | 2026-09-23 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body r… |
CVE-2026-59990 | High | 7.5 | 2026-09-23 | Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a… |
CVE-2026-95845 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast p… |
CVE-2026-96609 | | | 2026-09-23 | Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condi… |
CVE-2026-78383 | High | 7.5 | 2026-09-23 | Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leadi… |
CVE-2026-89425 | High | 7.5 | 2026-09-23 | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier char… |
CVE-2026-18170 | Medium | 6.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without… |
CVE-2025-12767 | Medium | 5.3 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excess… |
CVE-2026-76716 | Medium | 5.3 | 2026-09-22 | Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remot… |
CVE-2026-94455 | High | 7.1 | 2026-09-22 | An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only… |
CVE-2026-81886 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable… |
CVE-2026-81885 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable becaus… |