Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,246

Export CSV
CVE-2026-123566

Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123514

Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion

Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-124437

Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Scriban
Products
Scriban
CVE-2026-123531

Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-20356

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 2 more
CVE-2023-5157

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 15 more
CVE-2023-42669

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Enterprise Linux Eus Enterprise Linux For Ibm Z Systems and 8 more
CVE-2023-39329

Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c

A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Uclouvain
Products
Ai Inference Server Enterprise Linux Rhel Els and 1 more
CVE-2023-3108

Kernel: a race condition in crypto module in the function skcipher_recvmsg

A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Els
CVE-2023-39327

Openjpeg: malicious files can cause the program to enter a large loop

A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Uclouvain
Products
Ai Inference Server Enterprise Linux Rhel Els and 1 more
CVE-2024-6126

Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2023-43786

Libx11: stack exhaustion from infinite recursion in putsubimage()

A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat X.org
Products
Fedora Enterprise Linux Rhel Els and 1 more
CVE-2023-42670

Samba: ad dc busy rpc multiple listener dos

A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Redhat Samba
Products
Fedora Enterprise Linux Rhel Els and 2 more
CVE-2023-39328

Openjpeg: denail of service via crafted image file

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Uclouvain
Products
Enterprise Linux Rhel Els Openjpeg
CVE-2026-63476

isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Isomorphic-git
Products
Isomorphic-git
CVE-2026-111751

Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Angular
Products
Angular
CVE-2026-121438

Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lepture Mistune Project
Products
Mistune Mistune
CVE-2026-120656

CVE-2026-120656

OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Openkruise
Products
Kruise
CVE-2026-76893

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tsparticles
Products
Mcp-server Tsparticles
CVE-2026-63655

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tsparticles
Products
Mcp-server Tsparticles