CVE-2026-102820 | Medium | 6.2 | 2026-09-29 | pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pag… |
CVE-2026-102809 | Medium | 6.5 | 2026-09-29 | PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size para… |
CVE-2026-92550 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-88382 | High | 7.5 | 2026-09-24 | hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. |
CVE-2026-96260 | Medium | 6.5 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation… |
CVE-2026-77322 | High | 7.5 | 2026-09-22 | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without settin… |
CVE-2026-59991 | High | 7.5 | 2026-09-22 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers f… |
CVE-2026-58268 | High | 7.5 | 2026-09-22 | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer fr… |
CVE-2026-77619 | | | 2026-09-22 | Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network… |
CVE-2026-94626 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unb… |
CVE-2026-62370 | Medium | 6.5 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2… |
CVE-2026-47321 | High | 7.5 | 2026-09-21 | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting s… |
CVE-2026-77301 | High | 7.5 | 2026-09-18 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directo… |
CVE-2026-93019 | Critical | 9.1 | 2026-09-18 | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two… |
CVE-2026-93307 | Medium | 4.3 | 2026-09-17 | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argumen… |
CVE-2026-85715 | High | 7.5 | 2026-09-17 | ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src… |
CVE-2026-20295 | High | 8.6 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated… |
CVE-2026-77410 | | | 2026-09-16 | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header… |
CVE-2026-55149 | High | 7.5 | 2026-09-15 | Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total p… |
CVE-2026-91752 | High | 7.5 | 2026-09-15 | GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array… |
CVE-2026-53716 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFrom… |
CVE-2026-53717 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wa… |
CVE-2026-82435 | Critical | 9.8 | 2026-09-14 | Description
The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline
and acts on frames before any authentica… |
CVE-2026-67211 | High | 7.5 | 2026-09-11 | OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer
Versions Affected:
- 3.0.0-M4
- 3.0.0-M5
(The opennlp-spellche… |
CVE-2026-89092 | Medium | 4.2 | 2026-09-11 | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
stack overflow when a malicious DNS server returns too large a response
for a DNS quer… |
CVE-2026-88045 | High | 7.5 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed m… |
CVE-2026-83530 | Medium | 4.3 | 2026-09-09 | A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocatio… |
CVE-2026-86776 | Low | 3.3 | 2026-09-09 | KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a m… |
CVE-2026-85201 | | | 2026-09-07 | In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received thr… |
CVE-2026-19204 | | | 2026-09-07 | A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and pot… |
CVE-2026-85445 | High | 7.5 | 2026-09-03 | MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers… |
CVE-2026-85442 | High | 7.5 | 2026-09-03 | MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unb… |
CVE-2026-84888 | Medium | 4.3 | 2026-09-03 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
CVE-2026-84857 | Medium | 5.3 | 2026-09-02 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
CVE-2026-84289 | Medium | 4.3 | 2026-09-01 | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the co… |
CVE-2026-81693 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
CVE-2026-81692 | High | 7.5 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
CVE-2026-77354 | | | 2026-08-21 | kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go conver… |
CVE-2026-44253 | Medium | 4.9 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protoc… |
CVE-2026-75935 | High | 7.5 | 2026-08-18 | Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a cr… |
CVE-2026-69219 | | | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabb… |
CVE-2026-46603 | High | 7.5 | 2026-08-14 | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree gr… |
CVE-2026-72687 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decode… |
CVE-2026-72678 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An au… |
CVE-2026-72656 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CA… |
CVE-2026-72645 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated use… |
CVE-2026-72639 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is… |
CVE-2026-19566 | High | 7.5 | 2026-08-12 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
The _encode method accepts an… |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images.
Typi… |
CVE-2026-71218 | Medium | 5.3 | 2026-08-11 | A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled messag… |
CVE-2026-15567 | High | 7.5 | 2026-08-11 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled lengt… |
CVE-2026-66485 | | | 2026-08-10 | GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory base… |
CVE-2026-44630 | High | 7.5 | 2026-08-10 | Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a cra… |
CVE-2026-66733 | High | 7.5 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-70377 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validati… |
CVE-2026-67589 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-67551 | High | 7.5 | 2026-08-05 | pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects A… |
CVE-2026-66273 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-69702 | Medium | 6.5 | 2026-08-04 | SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplyi… |
CVE-2026-58067 | | | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. |
CVE-2026-15337 | Medium | 5.3 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
`django.utils.translation.check_for_language()` is subject to a potential denial-of-s… |
CVE-2026-14682 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Jav… |
CVE-2026-12852 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check. |
CVE-2026-58060 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java… |
CVE-2026-59649 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java L… |
CVE-2026-59646 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java… |
CVE-2026-12185 | High | 8.6 | 2026-08-03 | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Jav… |
CVE-2026-55768 | | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the buil… |
CVE-2026-54638 | High | 7.5 | 2026-07-28 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled da… |
CVE-2026-54890 | High | 7.5 | 2026-07-27 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Ex… |
CVE-2026-65315 | High | 7.5 | 2026-07-21 | Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by… |
CVE-2026-47667 | High | 7.5 | 2026-07-21 | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the fi… |
CVE-2026-59844 | Medium | 6.5 | 2026-07-21 | A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to all… |
CVE-2025-71395 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when u… |
CVE-2026-44453 | High | 7.5 | 2026-07-16 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloc… |
CVE-2026-55407 | | | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's p… |
CVE-2026-58559 | Medium | 6.5 | 2026-07-15 | DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-40378 | High | 7.5 | 2026-07-14 | Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over… |
CVE-2026-59204 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000… |
CVE-2026-55213 | High | 7.5 | 2026-07-10 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instru… |
CVE-2026-55782 | | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archiv… |
CVE-2026-55781 | | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive… |
CVE-2026-40006 | High | 7.5 | 2026-07-10 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability i… |
CVE-2026-59938 | Medium | 5.3 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large c… |
CVE-2026-15053 | High | 7.5 | 2026-07-08 | Tanium addressed a denial of service vulnerability in Tanium Server. |
CVE-2026-14454 | Critical | 9.8 | 2026-07-08 | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.
Imager mishandled large EXIF IFD entry count values, treating them as ne… |
CVE-2026-55079 | Medium | 4.9 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8… |
CVE-2026-55380 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in sel… |
CVE-2026-55379 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker… |
CVE-2026-54060 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (… |
CVE-2026-54059 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them dire… |
CVE-2026-14684 | Low | 3.3 | 2026-07-05 | A flaw has been found in HdrHistogram up to 2.2.2. This affects the function org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file src/main/java/… |
CVE-2026-14683 | Low | 3.3 | 2026-07-04 | A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by this issue is the function org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuf… |
CVE-2026-11946 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust
server memory via the GetEndpoints Discovery Service in open62541. The
endpointUrl field of GetEndpointsRequest… |
CVE-2026-33592 | High | 7.5 | 2026-07-02 | An unauthenticated remote attacker can exhaust
server memory via the FindServers Discovery Service in open62541. The
serverUris field of FindServersRequest is… |
CVE-2026-53917 | High | 7.5 | 2026-06-30 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenti… |
CVE-2026-53916 | High | 7.5 | 2026-06-30 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
An unauthenticated client that open… |
CVE-2026-50734 | High | 7.5 | 2026-06-30 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker… |
CVE-2026-53428 | | | 2026-06-29 | Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded m… |