PT-2026-24688

Name of the Vulnerable Software and Affected Versions flagd versions prior to 0.14.2 Description flagd, a feature flag daemon, exposes OFREP '/ofrep/v1/evaluate/...' and gRPC evaluation.v1, evaluation.v2 endpoints for feature flag evaluation. These endpoints are designed for public access by clie...

TinyWeb 资源管理错误漏洞

TinyWeb is a simple and lightweight HTTP server developed by Konstantin Belyalov. Versions of TinyWeb prior to 2.02 contained a resource management vulnerability; this vulnerability stemmed from the lack of restrictions on the size of HTTP requests, which could lead to memory exhaustion and serve...

GHSA-7RQC-FF8M-7J23 Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Summary A Denial of Service DoS vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint /signalk/v1/access/requests. This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Details The...

CVE-2025-34469 Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification

Cowrie versions prior to 2.9.0 contain a server-side request forgery SSRF vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound HTTP requests to attacker-supplied destinations. Because no...

CVE-2025-66473

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of...

CVE-2025-66473 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of...

CVE-2025-63402

An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests...

CVE-2025-63402

An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests...

CVE-2025-63402

An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests...

PT-2025-50549

Name of the Vulnerable Software and Affected Versions XWiki versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0 Description The XWiki platform contains a REST API that does not limit the number of items requested in a single request. This can cause performance...

CVE-2024-8062 Denial of Service in h2oai/h2o-3

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a HEAD request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controll...

CVE-2024-8062

CVE-2024-8062 affects the h2oai/h2o-3 package (version 3.46.0) via the typeahead endpoint. The vulnerability arises when the endpoint uses a HEAD request to verify resource existence without a timeout, which can be exploited by sending many requests to an attacker‑controlled server that hangs, ca...

Apache Commons FileUpload 安全漏洞

Apache Commons FileUpload is the United States Apache Apache Foundation of a file can be uploaded to the Servlet and Web applications package. A denial of service vulnerability exists in Apache Commons FileUpload versions prior to 1.5, which stems from a failure to limit the number of requests an...