GenAI-LLM-Top10

OWASP Top 10 for Large Language Model Applications !IMPORTANT Current release: 2026 — published August 4, 2026. Get the 2026 publication · Read the canonical source · Report a correction This is the official source repository for the OWASP Top 10 for Large Language Model Applications , maintained...

CVE-2026-128132

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader continues parsing frames already received after the receive queue pauses the transport, and empty messages are not counted toward the queue size. With permessage-deflate, one read...

CVE-2026-128131

The aiohttp asynchronous HTTP client/server framework for asyncio and Python (versions prior to 3.14.4 ) is vulnerable to a quadratic CPU use issue. When processing payloads with concatenated gzip, deflate, or zstd streams, the software passes the entire remaining input to a new decompressor for ...

CVE-2026-128089

The dnspython DNS toolkit for Python is vulnerable to excessive memory and CPU consumption in versions prior to 2.9.2 . The root cause is located in the from_text() parser for WKS records , which fails to validate that the service number is between 0 and 65535 before using it as a bitmap offset. ...

raccoon

Raccoon: Salesforce object access auditor Released as open source by NCC Group Plc - https://www.nccgroup.com/ Developed by Jerome Smith @exploresecurity with thanks to Viktor Gazdag @wucpi https://www.github.com/nccgroup/raccoon Released under AGPL - refer to LICENSE for more information...

CVE-2025-24204

CVE-2025-24204 About CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement com.apple.system-task-ports.read to the gcore binary. Exploiting this vulnerabilit...

CVE-2026-36959

CVE-2026-36959: Missing Rate Limiting on Login Endpoint CVE ID: CVE-2026-36959 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts Description The U-SPEED Router...

Bluetooth-Crash-CVE-2017-0785

CVE-2017-0785 Bluetooth module crash This script is a modified version of https://github.com/ojasookert/CVE-2017-0785. It leaks information via SDP due to out-of-bound bytes, but sending too many packets or search requests causes the Bluetooth module on an Android smartphone above Android 4.0 to...

CVE-2026-103977

Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...

EUVD-2026-124780

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

CVE-2026-127274

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

crass: crass: Denial of Service via excessive recursion when processing comments

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

crass: crass: Denial of Service via excessive recursion when processing comments

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

crass: crass: Denial of Service via excessive recursion when processing comments

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

CVE-2026-127274

The Linksys EA8100 (firmware version 1.0.3.216940 ) contains a vulnerability in the /jnap/core/CheckAdminPassword file. This issue results in improper restriction of excessive authentication attempts , potentially allowing for brute-force attacks. While the attack is remote , it is characterized ...

CVE-2026-127274 Linksys EA8100 CheckAdminPassword excessive authentication

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

SUSE CVE-2025-12385

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick...

CLEANSTART-2026-YR58234 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-UL49545 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-XB27469 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C...

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130...