Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,413

Export CSV
CVE-2026-78586

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-85107

NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nousresearch
Products
Hermes-agent
CVE-2026-42154

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Prometheus
Products
Prometheus
CVE-2026-47891

Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59289

Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-59287

Spring for GraphQL WebSocket Client Denial of Service

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-47874

Reactor Netty HTTP Server Denial of Service With Pipelined Requests

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pivotal Spring
Products
Reactor Netty Reactor Netty
CVE-2026-19474

@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fastify
Products
Fastify-multipart
CVE-2026-58063

BCFKS keystore load honours unbounded KDF cost from untrusted file

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bouncy Castle For Java Lts Fips Java Api and 3 more
CVE-2026-72682

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72652

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72659

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72653

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72651

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-49089

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72667

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-33465

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72674

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-26445

stomper: stomper: Denial of Service via partial STOMP frames

stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker s use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—