Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,924

Export CSV
CVE-2026-41869

Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Nutch
CVE-2026-87822

t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tdunning
Products
T-digest
CVE-2026-73786

Unauthenticated Network-Based Denial of Service in CPPM systems

A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe)
Products
Clearpass Policy Manager (cppm)
CVE-2026-88286

GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Inc.
Products
Gv-lpc2011 Lpc2211
CVE-2026-18076

IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2023-54395

PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-88290

GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion

GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Inc.
Products
Gv-lpc2011 Lpc2211
CVE-2026-86432

commonmark 2.0.0 before 2.8.4 Denial of Service via XML

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thephpleague
Products
Commonmark
CVE-2026-86734

Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grokability Snipeitapp
Products
Snipe-it Snipe-it
CVE-2026-86202

PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86204

PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2025-71418

PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-47888

Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47886

Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-79378

Bluetooth L2CAP Packet–Based Denial of Service in Bestechnic BES2300 Firmware

An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bestechnic
Products
Bes2300