CVE-2026-114426

The SEPPmail Secure Email Gateway (versions prior to 15.1.1 ) is vulnerable to a resource exhaustion flaw. The software processes and writes v1 file-interface upload data without prior caller authentication and lacks an absolute request-size limit. This allows an unauthenticated remote attacker t...

CVE-2026-120955

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...

EUVD-2026-116137

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

lxsmnsyc seroval input validation error vulnerability

Versions of lxsmnsyc seroval prior to 1.6.8 contain a security vulnerability. This vulnerability arises because fromJSON and fromCrossJSON fail to validate the done index of sequence nodes. A specially crafted done index can create an iterator that never completes its iteration. When...

CVE-2026-91147

A denial-of-service flaw was identified in cockpit-ws , the web service component of Cockpit . When WebService.UrlRoot is configured, a remote, unauthenticated attacker can cause cockpit-ws to terminate unexpectedly by sending a request to the exact URL-root prefix without a trailing slash . The ...

CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-85450

MOOS core-moos through version 10.4.0 contains a denial of service vulnerability in its MOOSDB HTTP server component. The root cause is the creation of unbounded connections and threads without limits , allowing an attacker over the network (no authentication required) to open many connections an...

CVE-2026-72838

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72838

CVE-2026-72838 affects FileBrowser versions before 2.63.19. The root cause is that the TUS resumable-upload PATCH endpoint fails to enforce the declared Upload-Length, enabling authenticated users to write arbitrary data to disk. This can allow an attacker to send oversized request bodies that ex...

CVE-2026-72838: Allocation of Resources Without Limits or Throttling

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-56657

A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A remote attacker could potentially exploit this by submitting a specially crafted SSH key, leading to the unavailability of the Gitea service. Mitigation Mitigation for this issue is either not availabl...

Regular Expression Denial of Service (ReDoS)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Accept header processing. An attacker can exhaust CPU resources by sending specially crafted Accept headers, potentially leading to...

CVE-2026-35505

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart...

CVE-2025-61022

A flaw was found in openlink virtuoso-opensource. This issue, specifically within the sqlotbcolpreds component, allows attackers to cause a Denial of Service DoS by sending specially crafted SQL statements. This can lead to the unavailability of the service...

CVE-2026-47216: Improper Check for Unusual or Exceptional Conditions

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerability in the /multisearch endpoint. A specially crafted request can trigger an unhandled exception during request processing, causing the server process to...

qs: qs: Denial of Service via improper input validation in array parsing

A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...

SUSE CVE-2026-28379

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server...

EUVD-2026-30139

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server...

CVE-2026-28379

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server...