CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...

CVE-2026-103249

The n8n workflow automation tool is vulnerable to a stored DOM cross-site scripting (XSS) vulnerability in versions before 1.123.80 , 2.39.6 , and 2.40.1 . The root cause lies in the handling of the Resource Locator parameter dropdown link. Malicious workflow authors can inject script URLs that e...

CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...

EUVD-2026-90643

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...

CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to resource exhaustion. The vulnerability is due to unbounded symbol value caching, where symbol values are cached without size limits and a pre-authentication attacker can send crafted input to exhaust resources, leading to denial of service...

Resource Exhaustion

Apache Qpid Broker-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where an authenticated attacker can cause excessive resource usage and potential denial of service...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper enforcement of the session flow control incoming window, which allows an authenticated attacker to exceed the permitted window and cause resource exhaustion, potentially resulting in a...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to inefficient handling of large or invalid ranges in disposition frames, which allows an authenticated attacker to cause excessive CPU consumption and trigger a denial-of-service condition...

BIT-ELASTICSEARCH-2026-82300 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

Resource Allocation

com.github.java-json-tools, jackson-coreutils is vulnerable to resource allocation. The vulnerability is due to improper resource allocation in the TreePointer.tokensFromInput function of the JSON Pointer parser, which allows a remote attacker to exploit the parser and cause excessive resource...

CLEANSTART-2024-LZ69519 FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consu...

Security vulnerability affects the ffmpeg4 package. FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RA...

CVE-2026-102303

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=559727039 https://code.google.com/p/chromium/issues/detail?id=102303...

Uncontrolled Resource Consumption

multiparty is vulnerable to Uncontrolled Resource Consumption.The vulnerability is due to unrestricted memory usage while accumulating multipart part headers, which allows an unauthenticated attacker to send a request with excessively large headers and exhaust process memory, causing the server t...

CLEANSTART-2026-WY00600 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the docker-cli-buildx package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

thrift: thrift: Denial of Service via improper message handling in language bindings

A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...

thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport

A flaw was found in Apache Thrift's Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial ...

thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings

A flaw was found in the Apache Thrift PHP bindings. Due to a lack of limits or throttling on resource allocation, a remote attacker can send crafted requests that consume excessive system resources. This issue can lead to a Denial of Service DoS for the affected service...

thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings

A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service DoS. By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service...

thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

A flaw was found in the Apache Thrift Python bindings, which can lead to a Denial of Service DoS. Due to insecure default settings and a lack of limits or throttling on resource allocation, a remote unauthenticated attacker can cause excessive resource consumption. This behavior can exhaust...