CVE-2026-94644

A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a...

CVE-2026-113650

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-113656

The ApostropheCMS Form add-on for Node.js is vulnerable to a denial of service (DoS) via disk exhaustion. Prior to version 1.5.5 , the form submission route processes unbounded multipart uploads without prior authentication, validation, or enforcement of size, count, and rate limits. An unauthent...

CVE-2026-113650

The ApostropheCMS Node.js content management system is vulnerable in the sanitize-html 2.18.0 component due to unbounded recursion . When an is disallowed and disallowedTagsMode is set to 'discard' (the default), the raw-text content undergoes a recursive re-sanitization via sanitizeHtml(text, o...

EUVD-2026-105176

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-51416

1. Summary Vulnerability Type : Denial of Service / Unrestricted HTTP Response Reading CWE-400 Flagged Location : backend/internal/handler/authwechatoauth.go:1149 Vulnerability Description : The WeChat OAuth token exchange process uses io.ReadAllresp.Body to read the full upstream HTTP response...

CVE-2026-50787

CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre Summary A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre esiclivre. The vulnerable endpoint accepts user-controlled parameters that define CAPTCHA image dimensions, font size, and the...

CVE-2026-65650

CVE-2026-65650 — PoC: Authenticated DoS in Elgg Avatar Upload Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion. Affected: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail'; PHP's G...

python3.14-urllib3 security update

An update is available for python3.14-urllib3. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programmin...

RLSA-2026:84578 Important: python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python3.14-urllib3 security update

An update is available for python3.14-urllib3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

libheif-cve-2026-50142

CVE-2026-50142 — libheif Unbounded heap allocation in HEIF sequence parser stsz fixed-size mode Severity: High CVSS 7.5 Advisory: GHSA-jvmp-j3cw-84mh Fixed: commit a6caa38 by @farindk Time to fix: 1 hour Summary A 1,477-byte crafted HEIF file triggers 7 GB unchecked heap allocation in Chunk::Chun...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

GO-2026-6720 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass...

GO-2026-6690 Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza...

CVE-2026-112368

The MongoDB PHP driver contains an uncontrolled recursion weakness (CWE-674) within its BSON decoding logic, specifically in the phongo_bson_visit_document/visit_array functions. An unauthenticated attacker can provide crafted binary document data to the decoder to exhaust the process stack. This...

CVE-2026-112368 Unbounded Recursion in phongo_bson_visit_document/visit_array:

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting ...

CVE-2026-112214

A vulnerability exists in the GStreamer ASF demuxer within the gst-plugins-ugly component. The flaw occurs when parsing a Simple Index object , where an attacker-controlled entry count is used to determine the size of a heap allocation without being restricted to the actual payload size. Processi...

CVE-2026-112214 Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...

CVE-2026-112214 Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...