Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,053

Export CSV
CVE-2026-108329

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Threat Response
CVE-2026-108310

Tanium addressed a denial of service vulnerability in Tanium Server.

Tanium addressed a denial of service vulnerability in Tanium Server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Tanium Server
CVE-2026-108303

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Certificate Manager
CVE-2026-104895

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115357

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-81009

kernel: Linux kernel: Denial of Service in io_uring/query due to excessive memory zeroing

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 4.7 Medium EPSS n/a KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-86983

swift-crypto: swift-crypto: Denial of Service via unbounded input to the P-384 VOPRF API

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Swift-crypto
CVE-2026-78661

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-108311

Tanium addressed an insufficient logging vulnerability in Tanium Server.

Tanium addressed an insufficient logging vulnerability in Tanium Server.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Tanium Server
CVE-2026-115448

Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble. This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Zookeeper
CVE-2026-115391

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-100302

Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling

Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Zookeeper
CVE-2026-112671

Resource Exhaustion Denial of Service via Improper Input Validation in Apple OS

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to cause a denial-of-service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 2 more
CVE-2026-102713

Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-117346

Denial of Service via Unlimited Undo Files in Bitcoin Core

Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bitcoin
Products
Bitcoin Core
CVE-2026-102723

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-119376

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite
CVE-2026-119204

pypdf: Possible large memory usage when parsing page tree

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Py-pdf
Products
Pypdf
CVE-2026-119196

pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pyasn1
Products
Pyasn1