CVE-2026-111279 | High | 7.5 | 2026-10-15 | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT… |
CVE-2026-103223 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length… |
CVE-2026-102466 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an… |
CVE-2026-102463 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.bin… |
CVE-2026-110258 | Medium | 5.5 | 2026-10-14 | OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JS… |
CVE-2026-110257 | Medium | 5.5 | 2026-10-14 | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_b… |
CVE-2026-85324 | High | 7.5 | 2026-10-13 | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
CVE-2026-33374 | Medium | 6.5 | 2026-10-13 | The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations th… |
CVE-2026-54700 | | | 2026-10-13 | ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inn… |
CVE-2026-54697 | | | 2026-10-13 | ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER… |
CVE-2026-109149 | Medium | 5.3 | 2026-10-13 | A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to… |
CVE-2020-37280 | High | 7.5 | 2026-10-12 | cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input… |
CVE-2026-108683 | Medium | 4.3 | 2026-10-11 | A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handle… |
CVE-2026-97853 | | | 2026-10-10 | Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested… |
CVE-2026-108106 | High | 7.5 | 2026-10-09 | Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncom… |
CVE-2026-107390 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size… |
CVE-2026-107389 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT el… |
CVE-2026-107388 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the co… |
CVE-2026-107387 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocate… |
CVE-2026-107223 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges withou… |
CVE-2026-107215 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from… |
CVE-2026-106569 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the… |
CVE-2026-106453 | Medium | 5.3 | 2026-10-06 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-le… |
CVE-2026-106452 | Medium | 5.3 | 2026-10-06 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a le… |
CVE-2026-103005 | Medium | 6.5 | 2026-10-06 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated use… |
CVE-2026-106114 | Medium | 5.3 | 2026-10-06 | ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dime… |
CVE-2026-77050 | Medium | 5.3 | 2026-10-06 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is sub… |
CVE-2026-105749 | Medium | 6.5 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HT… |
CVE-2026-78861 | High | 7.7 | 2026-10-05 | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key |
CVE-2026-93323 | | | 2026-10-05 | The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversi… |
CVE-2026-83745 | | | 2026-10-02 | Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift
nodejs and D lang bindings.
B… |
CVE-2026-82458 | | | 2026-10-02 | Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, Jav… |
CVE-2026-94633 | | | 2026-10-02 | Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings.
This issue af… |
CVE-2026-85494 | High | 7.5 | 2026-10-02 | Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initi… |
CVE-2026-102731 | High | 7.5 | 2026-10-02 | Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.
A malicious peer (or a MITM) can send a small BER-encoded response c… |
CVE-2026-63574 | | | 2026-10-02 | Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeS… |
CVE-2026-103603 | | | 2026-10-02 | Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp… |
CVE-2026-63566 | | | 2026-10-02 | Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-cs… |
CVE-2026-42528 | Medium | 4.3 | 2026-10-01 | A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processe… |
CVE-2026-102504 | High | 7.5 | 2026-10-01 | Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.
Nothing range-checks… |
CVE-2026-102510 | | | 2026-09-30 | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache… |
CVE-2026-102509 | | | 2026-09-30 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC… |
CVE-2026-102820 | Medium | 6.2 | 2026-09-29 | pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pag… |
CVE-2026-102809 | Medium | 6.5 | 2026-09-29 | PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size para… |
CVE-2026-92550 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-88382 | High | 7.5 | 2026-09-24 | hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. |
CVE-2026-96260 | Medium | 6.5 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation… |
CVE-2026-77322 | High | 7.5 | 2026-09-22 | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without settin… |
CVE-2026-59991 | High | 7.5 | 2026-09-22 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers f… |
CVE-2026-58268 | High | 7.5 | 2026-09-22 | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer fr… |
CVE-2026-77619 | | | 2026-09-22 | Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network… |
CVE-2026-94626 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unb… |
CVE-2026-62370 | Medium | 6.5 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2… |
CVE-2026-47321 | High | 7.5 | 2026-09-21 | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting s… |
CVE-2026-77301 | High | 7.5 | 2026-09-18 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directo… |
CVE-2026-93019 | Critical | 9.1 | 2026-09-18 | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two… |
CVE-2026-93307 | Medium | 4.3 | 2026-09-17 | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argumen… |
CVE-2026-85715 | High | 7.5 | 2026-09-17 | ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src… |
CVE-2026-20295 | High | 8.6 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated… |
CVE-2026-77410 | | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header… |
CVE-2026-55149 | High | 7.5 | 2026-09-15 | Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total p… |
CVE-2026-91752 | High | 7.5 | 2026-09-15 | GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array… |
CVE-2026-53716 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFrom… |
CVE-2026-53717 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wa… |
CVE-2026-82435 | Critical | 9.8 | 2026-09-14 | Description
The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline
and acts on frames before any authentica… |
CVE-2026-67211 | High | 7.5 | 2026-09-11 | OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer
Versions Affected:
- 3.0.0-M4
- 3.0.0-M5
(The opennlp-spellche… |
CVE-2026-89092 | Medium | 4.2 | 2026-09-11 | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
stack overflow when a malicious DNS server returns too large a response
for a DNS quer… |
CVE-2026-88045 | High | 7.5 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed m… |
CVE-2026-83530 | Medium | 4.3 | 2026-09-09 | A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocatio… |
CVE-2026-86776 | Low | 3.3 | 2026-09-09 | KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a m… |
CVE-2026-85201 | | | 2026-09-07 | In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received thr… |
CVE-2026-19204 | | | 2026-09-07 | A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and pot… |
CVE-2026-85445 | High | 7.5 | 2026-09-03 | MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers… |
CVE-2026-85442 | High | 7.5 | 2026-09-03 | MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unb… |
CVE-2026-84888 | Medium | 4.3 | 2026-09-03 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
CVE-2026-84857 | Medium | 5.3 | 2026-09-02 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
CVE-2026-84289 | Medium | 4.3 | 2026-09-01 | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the co… |
CVE-2026-81693 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
CVE-2026-81692 | High | 7.5 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
CVE-2026-77354 | | | 2026-08-21 | kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go conver… |
CVE-2026-44253 | Medium | 4.9 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protoc… |
CVE-2026-75935 | High | 7.5 | 2026-08-18 | Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a cr… |
CVE-2026-69219 | | | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabb… |
CVE-2026-46603 | High | 7.5 | 2026-08-14 | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree gr… |
CVE-2026-72687 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decode… |
CVE-2026-72678 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An au… |
CVE-2026-72656 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CA… |
CVE-2026-72645 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated use… |
CVE-2026-72639 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is… |
CVE-2026-19566 | High | 7.5 | 2026-08-12 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
The _encode method accepts an… |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images.
Typi… |
CVE-2026-71218 | Medium | 5.3 | 2026-08-11 | A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled messag… |
CVE-2026-15567 | High | 7.5 | 2026-08-11 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled lengt… |
CVE-2026-66485 | | | 2026-08-10 | GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory base… |
CVE-2026-44630 | High | 7.5 | 2026-08-10 | Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a cra… |
CVE-2026-66733 | High | 7.5 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-70377 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validati… |
CVE-2026-67589 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-67551 | High | 7.5 | 2026-08-05 | pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects A… |