Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,044

Export CSV
CVE-2026-126272

NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints

NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126277

NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API

NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126293

NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126394

vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames

vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Vllm
Products
Vllm
CVE-2026-126396

vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Vllm
Products
Vllm
CVE-2026-126399

vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames

vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Vllm
Products
Vllm
CVE-2026-126407

Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer

Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.

CVSS 4.0 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-126421

OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count

OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126938

Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128338

ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128339

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128340

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128341

ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128344

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-126613

Allocation of Resources Without Limits or Throttling in hMailServer

Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver
CVE-2026-68539

fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fulgur-rs
Products
Fulgur
CVE-2026-81843

Memory exhaustion denial of service in Elasticsearch data source index patterns

Grafana is an open-source platform for monitoring and observability. When an Elasticsearch data source is configured with a time-based index pattern, Grafana generated one index name for every interval in the requested query time range without any upper limit. A user with permission to query the data source, which includes users holding only the Viewer role in a default configuration, could submit a single small query with an extreme time range and cause the server to allocate memory until it was terminated. The allocation occurred before any request was sent to Elasticsearch, so the condition applied whether or not the Elasticsearch cluster was reachable. Data sources configured with a static index name are not affected.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
Grafana
Products
Elasticsearch Datasource Grafana Grafana Enterprise
CVE-2026-126659

BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Blueprints

BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Blueprintue
Products
Blueprintue-self-hosted-edition
CVE-2026-64861

Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getprobo
Products
Probo
CVE-2026-112314

Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more