Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,248

Export CSV
CVE-2026-6777

Other issue in the Networking: DNS component

Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-6781

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-6780

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-33750

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Juliangruber
Products
Brace-expansion
CVE-2026-2405

Denial of Service via Uncontrolled Resource Consumption on PowerChute Web Admin

CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Schneider-electric
Products
Powerchute Serial Shutdown
CVE-2026-6060

Possible DoS via SQL Box

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS:  * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.3.X

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs
CVE-2025-5986

Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Thunderbird Enterprise Linux Rhel Aus and 3 more
CVE-2025-9182

Denial-of-service due to out-of-memory in the Graphics: WebRender component

Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox Esr Thunderbird
CVE-2025-55028

JavaScript alerts could impede UI interaction or allow denial of service attacks

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-55029

Malicious scripts could spam popups for denial of service attacks

Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2026-35441

Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition. This vulnerability is fixed in 11.17.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Directus Monospace
Products
Directus Directus
CVE-2026-21485

iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-22228

Improper Input Validation Leading to DoS on TP-Link Archer BE230

An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file containing an excessively long parameter. Restoring such a file can cause the device to become unresponsive, requiring a reboot to restore normal operation. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Be230 Archer Be230 Firmware
CVE-2026-22541

DENIAL OF SERVICE VIA ICMP PACKETS

The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-21500

Stack Overflow in iccDEV XML Calculator Macro Expansion

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the XML calculator macro expansion. This issue has been patched in version 2.3.1.2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-22239

Email Sending Vulnerability in BLUVOYIX

The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Bluspark Global Blusparkglobal
Products
Bluvoyix Bluvoyix
CVE-2026-1174

birkir prime GraphQL Alias graphql resource consumption

A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GraphQL Alias Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Birkir
Products
Prime
CVE-2026-21942

Low Privilege Denial of Service via Filesystem Hang in Oracle Solaris 10 and 11

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Solaris
CVE-2026-21948

mysql: Optimizer unspecified vulnerability (CPU Jan 2026)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Mysql Server