1706 matches found
CVE-2026-126394
The vLLM library (versions 0.30.0 before 0.31.0 ) contains a resource exhaustion vulnerability in the OpenCVDynamicOpenPanguVideoBackend . The issue stems from the component using request-controlled num_frames without an effective ceiling. Unauthenticated attackers can trigger a denial of service...
EUVD-2026-125171
vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled numframes without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu videobackend wi...
CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...
CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...
CVE-2026-126366
The msgpack-ruby gem for the JRuby platform (versions prior to 1.8.7 ) is vulnerable to a memory exhaustion issue. The msgpack-java decoder incorrectly allocates arrays and byte buffers based on attacker-controlled sizes provided in array32 , str32 , and bin32 headers without verifying the availa...
php2shell-scanner
php2shell-scanner Non-destructive scanner with opt-in probe for CVE-2026-109618 RCE via OOM corruption and CVE-2026-109619 RCE via stale global state — core PHP bugs fixed in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. ✅ Verified against the official php-src advisories 2026-10-21, Critical. The CVE IDs an...
actual-php2shell
actual-php2shell A reproducible, application-independent remote code execution PoC against PHP 8.5.11 the October 2026 advisories. It turns the two 2026 PHP memory-corruption advisories into system"cat /etc/passwd" with no application code — the victim's index.php just echoes ok. CVE-2026-109618 ...
php-oom-longjmp
php2shell - php-oom-longjmp Someone on the internet can talk to your PHP site the same way a browser does, with no password. On last-affected PHP they can send a crafted file-upload request that makes the engine run out of memory while it is still reading the request, before your application...
CVE-2026-111436
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specsmount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered...
CVE-2026-111436
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specsmount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered...
CVE-2026-111436
The openEuler iSulad daemon on Linux contains a missing release of memory after effective lifetime vulnerability (CWE-401) in the file src/daemon/modules/spec/specs_mount.c. This issue affects versions through 2.1.6 . Frequent triggering of the vulnerability causes a memory leak that exhausts hos...
EUVD-2026-124258
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specsmount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered...
CVE-2026-111436: openEuler iSulad: Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specsmount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered...
PT-2026-145675
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs mount.c. This issue affects iSulad: through 2.1.6. The memory leak vulnerability causes the iSulad daemon to be triggered...
PHP2P4IM0NSHELL
🐘 PHP2P4IM0NSHELL v1.2 🧩 Extensión de navegador Manifest V3...
CVE-2026-32941
A framework-wide vulnerability in Sliver C2 allows for an unauthenticated, remote Denial of Service by triggering Uncontrolled Memory Allocation CWE-789 / CWE-400, leading to a process-wide Out-of-Memory OOM crash. References: Tenable Reproduction Steps: 1. Extract Credentials: Obtain the mTLS...
cve-2026-24514-Kubernetes-Dos
CVE-2026-24514 – Critical Memory Exhaustion in ingress-nginx Validating Admission Webhook Unauthenticated / low-privileged remote denial-of-service vulnerability allowing attackers to crash ingress-nginx controller pods via oversized AdmissionReview requests. Overview & Business Impact The...
CVE-2026-123523
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account...
CVE-2026-123523 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account...