CVE-2026-73508 | Medium | 5.3 | 2026-08-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io… |
CVE-2026-73215 | | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused… |
CVE-2026-11811 | Low | 3.7 | 2026-08-10 | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-set… |
CVE-2026-13505 | | | 2026-08-08 | In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by th… |
CVE-2026-49343 | Medium | 5.9 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-e… |
CVE-2026-20124 | High | 7.7 | 2026-08-05 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an a… |
CVE-2026-61387 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server… |
CVE-2026-64607 | Medium | 5.3 | 2026-07-31 | HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or un… |
CVE-2026-12353 | Medium | 5.3 | 2026-07-23 | An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint… |
CVE-2026-56444 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeo… |
CVE-2026-41637 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-c… |
CVE-2026-36590 | High | 7.5 | 2026-07-15 | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component |
CVE-2026-15713 | Medium | 5.9 | 2026-07-14 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termi… |
CVE-2026-54786 | Medium | 5.0 | 2026-07-01 | Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0… |
CVE-2026-13351 | High | 7.5 | 2026-06-25 | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 pack… |
CVE-2026-40209 | Medium | 5.3 | 2026-06-25 | An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXF… |
CVE-2026-53251 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
hci_get_route() ret… |
CVE-2026-53154 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: restore reservation on error in hugetlb folio copy paths
Two sites in mm/huge… |
CVE-2026-48043 | Medium | 5.3 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final… |
CVE-2026-48006 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggre… |
CVE-2026-45536 | Medium | 4.0 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_r… |
CVE-2026-46292 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved:
pmdomain: core: Fix detach procedure for virtual devices in genpd
If a device is attached… |
CVE-2026-45287 | Medium | 5.5 | 2026-06-04 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schem… |
CVE-2026-9156 | Medium | 6.5 | 2026-05-27 | Tanium addressed a denial of service vulnerability in Tanium Server. |
CVE-2026-39830 | Critical | 9.1 | 2026-05-22 | A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine cou… |
CVE-2026-42577 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP… |
CVE-2026-39455 | High | 7.5 | 2026-05-13 | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd… |
CVE-2026-35227 | | | 2026-05-12 | An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling… |
CVE-2026-43314 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
dm: remove fake timeout to avoid leak request
Since commit 15f73f5b3e59 ("blk-mq: move fa… |
CVE-2026-43257 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
media: cx88: Add missing unmap in snd_cx88_hw_params()
In error path, add cx88_alsa_dma_u… |
CVE-2026-43054 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
scsi: target: tcm_loop: Drain commands in target_reset handler
tcm_loop_target_reset() vi… |
CVE-2026-3104 | High | 7.5 | 2026-03-25 | A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
This issue affects BIND 9 versions 9.20.0 thro… |
CVE-2026-23299 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: purge error queues in socket destructors
When TX timestamping is enabled via S… |
CVE-2026-32874 | High | 7.5 | 2026-03-20 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak… |
CVE-2026-2261 | High | 7.5 | 2026-03-09 | Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.
Once a certain number of leaked sockets is reached… |
CVE-2026-26999 | High | 7.5 | 2026-03-05 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake o… |
CVE-2026-1605 | High | 7.5 | 2026-03-05 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: g… |
CVE-2026-20082 | High | 8.6 | 2026-03-04 | A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthent… |
CVE-2026-2359 | High | 7.5 | 2026-02-27 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of S… |
CVE-2025-71232 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Free sp in error path to fix system crash
System crash seen during load/un… |
CVE-2026-23219 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved:
mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
When CONFIG_MEM_AL… |
CVE-2026-23185 | High | 7.8 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: cancel mlo_scan_start_wk
mlo_scan_start_wk is not canceled on disconn… |
CVE-2026-21720 | High | 7.5 | 2026-01-27 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three se… |
CVE-2025-14969 | Medium | 4.3 | 2026-01-26 | A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connect… |
CVE-2026-21874 | Medium | 5.3 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and clo… |
CVE-2025-65947 | | | 2025-11-21 | thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on… |
CVE-2025-64734 | Low | 2.4 | 2025-11-18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-s… |
CVE-2025-54983 | Medium | 5.2 | 2025-11-12 | A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released a… |
CVE-2025-62723 | Medium | 4.3 | 2025-10-24 | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect… |
CVE-2025-36128 | High | 7.5 | 2025-10-16 | IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations… |
CVE-2025-61670 | Low | 3.3 | 2025-10-07 | Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAss… |
CVE-2023-53199 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Syzkaller detected… |
CVE-2023-53152 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
The following call trace is observ… |
CVE-2025-30256 | High | 8.6 | 2025-08-20 | A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests… |
CVE-2023-32255 | Medium | 5.3 | 2025-08-02 | A flaw was found in the Linux kernel's ksmbd component. A memory leak can occur if a client sends a session setup request with an unknown NTLMSSP message type… |
CVE-2025-36071 | Medium | 6.5 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the s… |
CVE-2025-44003 | Medium | 4.3 | 2025-07-10 | Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perfor… |
CVE-2022-50189 | High | 7.1 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved:
tools/power turbostat: Fix file pointer leak
Currently if a fscanf fails then an early re… |
CVE-2025-0036 | Low | 3.2 | 2025-06-10 | In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrect… |
CVE-2025-3864 | | | 2025-05-28 | Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust co… |
CVE-2025-27421 | High | 7.5 | 2025-03-03 | Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (… |
CVE-2025-22891 | High | 7.5 | 2025-02-05 | When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop pr… |
CVE-2025-24120 | High | 7.5 | 2025-01-27 | This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An a… |
CVE-2024-53074 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't leak a link on AP removal
Release the link mapping resource in… |
CVE-2024-52303 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur… |
CVE-2024-10396 | Medium | 6.5 | 2024-11-14 | An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and… |
CVE-2024-49769 | High | 7.5 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to cal… |
CVE-2024-20493 | Medium | 5.3 | 2024-10-23 | A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Fi… |
CVE-2024-20481 | Medium | 5.8 | 2024-10-23 | A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2024-47733 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
netfs: Delete subtree of 'fs/netfs' when netfs module exits
In netfs_init() or fscache_pr… |
CVE-2024-41890 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
User sends multiple pas… |
CVE-2024-41888 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
The password reset link… |
CVE-2024-39562 | High | 7.5 | 2024-07-10 | A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Netwo… |
CVE-2024-28882 | Medium | 4.3 | 2024-07-08 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing s… |
CVE-2021-47389 | Medium | 5.1 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: fix missing sev_decommission in sev_receive_start
DECOMMISSION the current SEV… |
CVE-2021-47283 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
net:sfc: fix non-freed irq in legacy irq mode
SFC driver can be configured via modparam t… |
CVE-2024-35821 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved:
ubifs: Set page uptodate in the correct place
Page cache reads are lockless, so setting t… |
CVE-2024-1300 | Medium | 5.4 | 2024-04-02 | A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server na… |
CVE-2024-2398 | High | 8.6 | 2024-03-27 | When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (10… |
CVE-2024-22383 | Medium | 6.2 | 2024-03-05 |
Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover… |
CVE-2024-21789 | High | 7.5 | 2024-02-14 |
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization… |
CVE-2023-31274 | Medium | 5.3 | 2024-01-18 |
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of… |
CVE-2023-47216 | Low | 2.9 | 2024-01-02 |
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources
|
CVE-2023-47124 | Medium | 5.9 | 2023-12-04 | Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt T… |
CVE-2023-20095 | High | 8.6 | 2023-11-01 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-45814 | Medium | 5.3 | 2023-10-18 | Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `Authentic… |
CVE-2023-41094 | Critical | 10.0 | 2023-10-04 | TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet… |
CVE-2023-36533 | High | 7.1 | 2023-08-08 | Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access. |
CVE-2023-1150 | High | 7.5 | 2023-06-26 | Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially craft… |
CVE-2023-22996 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device. |
CVE-2023-22302 | Medium | 5.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and cond… |
CVE-2022-45887 | Medium | 4.7 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_deta… |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-32149 | High | 7.5 | 2022-10-14 | An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. |
CVE-2022-31222 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exp… |
CVE-2022-40280 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-22215 | Medium | 6.5 | 2022-07-20 | A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module (PAM) of Juniper Networks Junos OS and… |
CVE-2022-29884 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All ve… |
CVE-2021-42860 | High | 7.5 | 2022-05-26 | A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml… |
CVE-2021-42859 | High | 7.5 | 2022-05-26 | A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the… |