CVE-2026-74788 | High | 7.5 | 2026-08-16 | Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template… |
CVE-2026-74786 | Medium | 6.5 | 2026-08-16 | Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypas… |
CVE-2026-74784 | | | 2026-08-16 | Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLi… |
CVE-2026-73062 | High | 7.5 | 2026-08-16 | Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing Loo… |
CVE-2026-73060 | High | 7.5 | 2026-08-16 | Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left… |
CVE-2026-72888 | | | 2026-08-16 | Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.
smart_require stores results i… |
CVE-2026-19474 | High | 7.5 | 2026-08-15 | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave com… |
CVE-2026-73635 | | | 2026-08-15 | Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text loo… |
CVE-2026-19830 | Medium | 5.3 | 2026-08-14 | A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component… |
CVE-2026-72838 | Medium | 6.5 | 2026-08-14 | FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to writ… |
CVE-2026-19617 | Medium | 5.5 | 2026-08-14 | A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This cou… |
CVE-2026-56862 | High | 7.5 | 2026-08-13 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a ma… |
CVE-2026-56859 | High | 7.5 | 2026-08-13 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. |
CVE-2026-56853 | High | 7.5 | 2026-08-13 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Read… |
CVE-2026-17076 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests. |
CVE-2026-72684 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Pr… |
CVE-2026-72674 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied… |
CVE-2026-72667 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially craf… |
CVE-2026-72659 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafte… |
CVE-2026-72653 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u… |
CVE-2026-72651 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u… |
CVE-2026-49089 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression… |
CVE-2026-17199 | High | 7.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation. |
CVE-2026-73565 | Medium | 5.3 | 2026-08-13 | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a miss… |
CVE-2026-42931 | Medium | 6.5 | 2026-08-13 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint |
CVE-2026-70464 | High | 7.5 | 2026-08-13 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by s… |
CVE-2026-70455 | High | 7.5 | 2026-08-13 | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias… |
CVE-2026-14456 | High | 7.5 | 2026-08-13 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
valid QUIC Initial packets for unknown destination connection IDs, it
can allocate a… |
CVE-2026-48702 | High | 7.5 | 2026-08-13 | Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpin… |
CVE-2026-73500 | | | 2026-08-12 | etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an et… |
CVE-2026-73493 | High | 7.5 | 2026-08-12 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragment… |
CVE-2026-71469 | High | 7.5 | 2026-08-12 | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates… |
CVE-2026-18096 | Low | 3.3 | 2026-08-12 | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak. |
CVE-2026-63299 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify… |
CVE-2026-7427 | Medium | 5.3 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-17271 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size. |
CVE-2026-71408 | Medium | 5.3 | 2026-08-12 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all version… |
CVE-2025-41770 | High | 7.5 | 2026-08-12 | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via th… |
CVE-2026-63133 | Medium | 6.5 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, director… |
CVE-2026-48804 | High | 7.5 | 2026-08-11 | python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in… |
CVE-2026-73228 | Medium | 5.3 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._p… |
CVE-2026-48809 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python… |
CVE-2026-48802 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecess… |
CVE-2026-73214 | | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/… |
CVE-2026-73089 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct… |
CVE-2026-54113 | High | 7.5 | 2026-08-11 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. |
CVE-2026-15561 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connec… |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-66761 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consum… |
CVE-2026-58238 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that caus… |
CVE-2026-72914 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics end… |
CVE-2026-18618 | High | 7.5 | 2026-08-10 | A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issu… |
CVE-2025-15682 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT… |
CVE-2026-12570 | Medium | 5.5 | 2026-08-10 | A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.mode… |
CVE-2026-52880 | High | 7.5 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of se… |
CVE-2026-52879 | High | 7.5 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new gorout… |
CVE-2026-46405 | Medium | 5.3 | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an… |
CVE-2026-19015 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoin… |
CVE-2026-19014 | Medium | 4.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization e… |
CVE-2026-15972 | High | 7.5 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection accepta… |
CVE-2025-71411 | Medium | 5.3 | 2026-08-07 | Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack… |
CVE-2025-71410 | Medium | 5.3 | 2026-08-07 | Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requ… |
CVE-2026-67585 | | | 2026-08-07 | Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erl… |
CVE-2026-48082 | Low | 3.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge end… |
CVE-2026-54225 | High | 7.5 | 2026-08-06 | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default pl… |
CVE-2026-18649 | High | 7.5 | 2026-08-06 | A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on t… |
CVE-2026-71321 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` dec… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-71310 | Medium | 5.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper i… |
CVE-2026-16100 | Medium | 6.5 | 2026-08-05 | A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operation… |
CVE-2026-59675 | High | 7.5 | 2026-08-05 | When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the… |
CVE-2026-55996 | Medium | 4.3 | 2026-08-05 | A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters a… |
CVE-2026-68078 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-68075 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Broke… |
CVE-2026-67592 | High | 7.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67591 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-67555 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67553 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-66277 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-66275 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-68074 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-68060 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-67588 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-67465 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-66257 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-68494 | | | 2026-08-04 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is inco… |
CVE-2026-67199 | Medium | 6.5 | 2026-08-04 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted e… |
CVE-2026-18401 | | | 2026-08-04 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 cha… |
CVE-2026-69152 | High | 7.5 | 2026-08-03 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not appl… |
CVE-2026-69079 | | | 2026-08-03 | CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-contr… |
CVE-2026-13586 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-58063 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-20482 | Medium | 6.5 | 2026-08-03 | In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additi… |
CVE-2026-59648 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59647 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-15055 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2026-55734 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom… |
CVE-2026-55733 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary… |
CVE-2026-54894 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary… |