CVE-2026-97370 | High | 7.5 | 2026-10-15 | Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly exe… |
CVE-2026-104266 | Medium | 6.5 | 2026-10-15 | tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom c… |
CVE-2026-110836 | Medium | 6.5 | 2026-10-14 | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via craft… |
CVE-2026-107349 | High | 7.5 | 2026-10-14 | An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options para… |
CVE-2026-107348 | Medium | 5.9 | 2026-10-14 | Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service w… |
CVE-2026-96596 | | | 2026-10-14 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix… |
CVE-2026-102185 | High | 7.5 | 2026-10-14 | A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a… |
CVE-2026-102046 | High | 7.5 | 2026-10-14 | A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated networ… |
CVE-2026-101895 | | | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23… |
CVE-2016-20099 | Medium | 5.5 | 2026-10-14 | L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang applications via cra… |
CVE-2026-78633 | Medium | 6.5 | 2026-10-13 | The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to… |
CVE-2026-109941 | Medium | 6.5 | 2026-10-13 | FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending inc… |
CVE-2026-109832 | High | 7.5 | 2026-10-13 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUT… |
CVE-2026-107391 | Medium | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regressi… |
CVE-2026-107696 | Medium | 6.5 | 2026-10-08 | FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect li… |
CVE-2026-107695 | Medium | 6.5 | 2026-10-08 | FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist()… |
CVE-2026-107677 | Medium | 4.7 | 2026-10-08 | FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty Seg… |
CVE-2026-107577 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5… |
CVE-2026-106164 | High | 7.3 | 2026-10-07 | In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS… |
CVE-2026-106568 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded… |
CVE-2026-106567 | Medium | 5.9 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger… |
CVE-2026-106565 | Medium | 5.9 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check whi… |
CVE-2026-107168 | Medium | 6.2 | 2026-10-07 | A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to ent… |
CVE-2026-104633 | Medium | 6.5 | 2026-10-06 | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads… |
CVE-2026-106121 | Medium | 4.9 | 2026-10-06 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.jso… |
CVE-2026-88252 | Medium | 4.7 | 2026-10-06 | A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles use… |
CVE-2026-106116 | Medium | 5.3 | 2026-10-06 | ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared e… |
CVE-2026-94654 | | | 2026-10-02 | Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
U… |
CVE-2026-85476 | | | 2026-10-02 | Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
U… |
CVE-2026-86537 | | | 2026-10-02 | Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bi… |
CVE-2026-86535 | | | 2026-10-02 | Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability… |
CVE-2026-93925 | | | 2026-10-02 | Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol.
This issue affects Apache Thrift: before… |
CVE-2026-63575 | | | 2026-10-02 | Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allow… |
CVE-2026-63570 | | | 2026-10-02 | Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can s… |
CVE-2026-96780 | | | 2026-10-01 | figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded… |
CVE-2026-103492 | Medium | 6.5 | 2026-10-01 | In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments |
CVE-2026-102511 | | | 2026-09-30 | Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to se… |
CVE-2026-102253 | High | 7.5 | 2026-09-29 | iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive wo… |
CVE-2026-102726 | | | 2026-09-29 | Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read |
CVE-2026-102714 | | | 2026-09-29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one… |
CVE-2026-97688 | Medium | 5.3 | 2026-09-29 | urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the… |
CVE-2026-96418 | Medium | 5.5 | 2026-09-29 | TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-95386 | Medium | 5.5 | 2026-09-29 | TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service |
CVE-2026-97362 | High | 7.5 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of avai… |
CVE-2026-6668 | High | 7.5 | 2026-09-23 | Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficie… |
CVE-2026-81885 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable becaus… |
CVE-2026-87082 | High | 7.5 | 2026-09-22 | Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
Neither backend chec… |
CVE-2026-82560 | High | 7.5 | 2026-09-19 | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
… |
CVE-2026-61633 | Low | 2.0 | 2026-09-18 | NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not han… |
CVE-2026-93690 | High | 7.5 | 2026-09-18 | uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode… |
CVE-2026-84446 | High | 7.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing… |
CVE-2026-68537 | High | 7.5 | 2026-09-17 | `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct c… |
CVE-2026-68523 | High | 7.5 | 2026-09-17 | `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct c… |
CVE-2026-85715 | High | 7.5 | 2026-09-17 | ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src… |
CVE-2026-20154 | High | 8.6 | 2026-09-16 | A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Sec… |
CVE-2026-62949 | Medium | 6.5 | 2026-09-16 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prio… |
CVE-2026-81876 | High | 7.5 | 2026-09-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/… |
CVE-2026-84997 | High | 7.5 | 2026-09-16 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter… |
CVE-2026-69210 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Inte… |
CVE-2026-91952 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rec… |
CVE-2026-80489 | Medium | 5.9 | 2026-09-15 | Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may re… |
CVE-2026-77117 | Medium | 5.9 | 2026-09-15 | Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may… |
CVE-2026-15923 | Medium | 4.6 | 2026-09-14 | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, fun… |
CVE-2023-37366 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exyn… |
CVE-2026-78132 | High | 7.5 | 2026-09-11 | strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. |
CVE-2026-78129 | Medium | 5.9 | 2026-09-11 | strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. |
CVE-2026-89045 | Medium | 4.0 | 2026-09-10 | zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infi… |
CVE-2026-88002 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backe… |
CVE-2026-88000 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id}… |
CVE-2026-87013 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed… |
CVE-2026-6554 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the… |
CVE-2026-85730 | | | 2026-09-04 | smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline t… |
CVE-2026-78543 | Medium | 5.3 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-84309 | Medium | 5.5 | 2026-09-01 | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_st… |
CVE-2026-82605 | Medium | 4.3 | 2026-08-31 | A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such ma… |
CVE-2026-82579 | | | 2026-08-31 | Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool… |
CVE-2026-47863 | Medium | 5.9 | 2026-08-27 | In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Rea… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2025-10903 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain con… |
CVE-2026-55588 | Medium | 6.5 | 2026-08-25 | ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive ref… |
CVE-2026-55373 | Medium | 6.2 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.1… |
CVE-2026-78250 | Medium | 4.3 | 2026-08-24 | A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipul… |
CVE-2026-45271 | Medium | 5.5 | 2026-08-21 | Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helpe… |
CVE-2026-54623 | High | 7.1 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/adm… |
CVE-2026-61556 | | | 2026-08-19 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts ca… |
CVE-2026-12629 | Medium | 4.6 | 2026-08-17 | The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun e… |
CVE-2026-68762 | Medium | 5.9 | 2026-08-17 | In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible |
CVE-2026-13002 | Medium | 4.4 | 2026-08-14 | A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dns… |
CVE-2026-17229 | High | 7.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. |
CVE-2026-17004 | High | 7.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. |
CVE-2026-12236 | Medium | 6.5 | 2026-08-13 | The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote G… |
CVE-2026-70462 | Medium | 6.5 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connec… |
CVE-2026-19484 | High | 7.5 | 2026-08-13 | @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending… |
CVE-2026-18726 | Medium | 6.5 | 2026-08-12 | A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiui… |
CVE-2026-11932 | Medium | 5.3 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-16931 | High | 7.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options. |
CVE-2026-72712 | Medium | 6.5 | 2026-08-11 | Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted pa… |
CVE-2026-8798 | | | 2026-08-08 | In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without an… |
CVE-2026-71436 | | | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid X… |
CVE-2026-71227 | Medium | 5.1 | 2026-08-05 | A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled… |