CWE-770 · Allocation of Resources Without Limits or Throttling (page 7)
Page 7 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3520 | High | 7.5 | 2026-03-04 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of S… |
CVE-2026-27932 | High | 7.5 | 2026-03-03 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource ex… |
CVE-2026-27601 | Medium | 5.9 | 2026-03-03 | Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very… |
CVE-2026-25673 | High | 7.5 | 2026-03-03 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which… |
CVE-2026-27887 | | 2026-02-26 | Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to allow connections to… | |
CVE-2026-27633 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhau… |
CVE-2026-27630 | High | 7.5 | 2026-02-26 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as S… |
CVE-2026-2845 | Medium | 6.5 | 2026-02-25 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed… |
CVE-2026-1725 | Medium | 5.3 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated… |
CVE-2026-1662 | High | 7.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-3525 | Medium | 6.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under… |
CVE-2026-3201 | Medium | 4.7 | 2026-02-25 | USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service |
CVE-2026-27695 | Medium | 4.3 | 2026-02-25 | zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same Dyn… |
CVE-2026-27572 | High | 7.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields`… |
CVE-2026-27204 | Medium | 6.5 | 2026-02-24 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susc… |
CVE-2026-25899 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbound… |
CVE-2026-27571 | Medium | 5.9 | 2026-02-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed mes… |
CVE-2026-25985 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file con… |
CVE-2026-27729 | Medium | 5.9 | 2026-02-24 | Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion Do… |
CVE-2026-26047 | Medium | 6.5 | 2026-02-21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits c… |
CVE-2026-27026 | Medium | 5.5 | 2026-02-20 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-26313 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high memory usage by sen… |
CVE-2026-26312 | Medium | 6.5 | 2026-02-19 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a… |
CVE-2026-25535 | High | 7.5 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If… |
CVE-2019-25350 | High | 7.5 | 2026-02-18 | XMedia Recode 3.4.8.6 contains a denial of service vulnerability that allows attackers to crash the application by loading a specially crafted .m3u playlist fi… |
CVE-2025-14876 | Medium | 5.5 | 2026-02-18 | A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to un… |
CVE-2019-25342 | High | 7.5 | 2026-02-12 | Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endp… |
CVE-2026-26076 | High | 7.5 | 2026-02-12 | ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above nor… |
CVE-2026-25949 | High | 7.5 | 2026-02-12 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticate… |
CVE-2026-21434 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's… |
CVE-2026-20608 | Medium | 5.5 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS T… |
CVE-2026-1837 | High | 7.5 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized un… |
CVE-2025-58471 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57711 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57710 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57708 | Medium | 6.5 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-54161 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54155 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54151 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54150 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54149 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2026-1458 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain co… |
CVE-2026-1456 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticate… |
CVE-2026-1387 | Medium | 6.5 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed… |
CVE-2025-8099 | High | 7.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2021-26381 | | 2026-02-10 | Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages… | |
CVE-2026-1850 | Medium | 6.5 | 2026-02-10 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. |
CVE-2026-1848 | High | 7.5 | 2026-02-10 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections excee… |
CVE-2026-1847 | Medium | 6.5 | 2026-02-10 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall… |
CVE-2026-23689 | High | 7.7 | 2026-02-10 | Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can re… |
CVE-2025-15317 | Medium | 6.5 | 2026-02-09 | Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. |
CVE-2026-0398 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. |
CVE-2025-31990 | Medium | 6.8 | 2026-02-07 | Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the syst… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-25762 | High | 7.5 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file… |
CVE-2025-32393 | Medium | 6.5 | 2026-02-05 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2020-37143 | High | 7.5 | 2026-02-05 | ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input fie… |
CVE-2020-37139 | High | 8.4 | 2026-02-05 | Odin Secure FTP Expert 7.6.3 contains a local denial of service vulnerability that allows attackers to crash the application by manipulating site information f… |
CVE-2020-37134 | High | 7.5 | 2026-02-05 | UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input. Attackers c… |
CVE-2026-25579 | Medium | 6.5 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supp… |
CVE-2025-1823 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e… |
CVE-2024-39724 | Medium | 5.3 | 2026-02-04 | IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resou… |
CVE-2026-25140 | High | 7.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromis… |
CVE-2026-25122 | Medium | 5.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip… |
CVE-2026-24514 | Medium | 6.5 | 2026-02-03 | A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending larg… |
CVE-2026-25224 | Low | 3.7 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response hand… |
CVE-2020-37085 | High | 7.5 | 2026-02-03 | VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through t… |
CVE-2020-37067 | Critical | 9.8 | 2026-02-03 | Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers to crash the service. Attackers can send… |
CVE-2025-58348 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58347 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58346 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58345 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58344 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58343 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58342 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58341 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58340 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2026-24133 | Medium | 6.5 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If g… |
CVE-2026-22780 | Medium | 4.4 | 2026-02-02 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, havi… |
CVE-2026-20406 | Medium | 6.5 | 2026-02-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2020-37039 | High | 7.5 | 2026-01-30 | Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface… |
CVE-2020-37038 | High | 7.5 | 2026-01-30 | Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field… |
CVE-2025-36387 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given spe… |
CVE-2025-36123 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service whe… |
CVE-2025-36098 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36070 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur… |
CVE-2025-2668 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenti… |
CVE-2025-68934 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payload… |
CVE-2025-61728 | Medium | 6.5 | 2026-01-28 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of servic… |
CVE-2025-61726 | High | 7.5 | 2026-01-28 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited… |
CVE-2025-68659 | Medium | 4.3 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulner… |
CVE-2020-36943 | High | 7.5 | 2026-01-28 | aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with exce… |
CVE-2026-24738 | Medium | 6.5 | 2026-01-27 | gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4… |
CVE-2026-23881 | High | 7.7 | 2026-01-27 | Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyver… |
CVE-2026-22259 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of mem… |
CVE-2026-22258 | High | 7.5 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, lea… |
CVE-2025-55102 | High | 7.5 | 2026-01-27 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet To… |
CVE-2020-36950 | Medium | 6.5 | 2026-01-27 | Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. A… |
CVE-2020-36949 | High | 7.5 | 2026-01-27 | TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input… |
CVE-2020-36946 | High | 7.5 | 2026-01-27 | SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an ov… |