Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,412

Export CSV
CVE-2026-45712

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Axllent
Products
Mailpit
CVE-2026-68060

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Broker-j
CVE-2026-66275

Apache Qpid Proton-J: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j
CVE-2026-66274

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j
CVE-2026-63299

Storage volume cross-project move and snapshot restore bypass project disk limits

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-67589

Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j Qpid Protonj2
CVE-2026-73565

@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hono
Products
Node-server
CVE-2026-110260

OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-115778

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Twisted
Products
Twisted
CVE-2026-75507

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Graphql-python
Products
Graphql-core
CVE-2026-111810

Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Traffic Server Traffic Server Apache Traffic Server
CVE-2026-109298

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openwebui
Products
Open Webui
CVE-2026-91409

openjdk: Enhance QUIC connections (Oracle CPU 2026-10)

Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Java Se Oracle Java Se
CVE-2026-111384

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nezhahq
Products
Nezha
CVE-2026-17271

IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-14511

IBM MQ Denial of Service

IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Mq
CVE-2026-112391

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python-pillow
Products
Pillow Pillow
CVE-2026-57487

libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pupnp Pupnp Project
Products
Pupnp Pupnp
CVE-2026-115398

Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nationalsecurityagency Nsa
Products
Ghidra Ghidra