Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,053

Export CSV
CVE-2026-54462

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Knative
Products
Pkg
CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2026-117511

desmondmorris node-tesseract Command Builder tesseract.js process os command injection

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Desmondmorris
Products
Node-tesseract
CVE-2026-116696

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Eugeny
Products
Russh
CVE-2026-116877

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Semantic-mediawiki
Products
Semantic Mediawiki
CVE-2026-116584

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Lxsmnsyc
Products
Seroval
CVE-2026-116506

TOTOLINK A950RG firewall.so apmib_set command injection

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed
Vendors
Totolink
Products
A950rg A950rg Firmware
CVE-2025-4416

Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Events Log Track Project
Products
Events Log Track
CVE-2026-120282

WAVLINK WN536AX6-A protocol.csp host_black os command injection

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Wavlink
Products
Wn536ax6-a
CVE-2026-120239

WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection

A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Wavlink
Products
Wn553x1-b
CVE-2026-120231

WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Wavlink
Products
Wn553x1-b
CVE-2026-120227

WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection

A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 2.2% KEV · Not listed
Vendors
Wavlink
Products
Wn701ae Wn701ae Firmware
CVE-2026-120197

WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection

A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Wavlink
Products
Wl-wn530hg4b
CVE-2026-115913

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2019-5413

nodejs-morgan: Unescaped input in compile() function

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Morgan Project
Products
Morgan
CVE-2026-11622

Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Isc
Products
Bind
CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending. A remote attacker can exhaust worker memory with a single connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miyagawa
Products
Starman
CVE-2026-114731

roundcubemail: roundcubemail: Denial of Service via CSS proxy memory exhaustion

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail
CVE-2026-114723

roundcubemail: roundcubemail: Denial of Service (DoS) via memory exhaustion during thumbnail generation

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail