EUVD-2025-210926

Memory Corruption when copying large input data exceeds normal allocation limits...

CLEANSTART-2026-VK48825 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

Multiple security vulnerabilities affect the grafana package. Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. See references for individual vulnerability details...

CVE-2026-50275: Allocation of Resources Without Limits or Throttling

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE-2026-89971: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...

CVE-2026-1168: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

CVE-2026-57173: Allocation of Resources Without Limits or Throttling

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-77403: Allocation of Resources Without Limits or Throttling

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

CVE-2026-91987

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91987 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

CVE-2026-91987 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

EUVD-2026-78647

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971

Vikunja versions before 2.6.0 are affected by a denial-of-service vulnerability in the avatar and project-background upload endpoints , where pixel decode limits are not enforced. Authenticated users can upload small images with extreme aspect ratios that decode to excessive pixel counts, consumi...

rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol

A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host vhost connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustio...

CVE-2026-92077: Allocation of Resources Without Limits or Throttling

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...