648838 matches found
EUVD-2026-83033
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...
EUVD-2026-83029
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...
EUVD-2026-83038
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures...
EUVD-2026-83016
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation...
EUVD-2025-210956
IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency...
CVE-2026-93752
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssTex...
CVE-2026-93752 CSSOM through 0.5.0 Denial of Service via length Property
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssTex...
CVE-2026-69186
GHSA-jv8r-gqr9-68wj: Memory-amplification denial of service via unvalidated DNS header record counts...
CVE-2026-93765
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...
CVE-2026-77239
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...
CVE-2026-77239
WACRM (a self-hostable CRM template for WhatsApp) versions 0.7.0 and earlier have an authorization flaw in flow and automation write routes. The routes authenticate account viewers but fail to enforce the agent role before invoking a service-role database client that bypasses row-level security. ...
CVE-2026-91147
A denial-of-service flaw was identified in cockpit-ws , the web service component of Cockpit . When WebService.UrlRoot is configured, a remote, unauthenticated attacker can cause cockpit-ws to terminate unexpectedly by sending a request to the exact URL-root prefix without a trailing slash . The ...
CVE-2026-91149 Cockpit: cockpit: denial of service via unbounded connection thread spawning
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as...
CVE-2026-91149 Cockpit: cockpit: denial of service via unbounded connection thread spawning
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as...
CVE-2026-91149
A flaw in Cockpit allows an unauthenticated remote attacker to trigger a denial of service by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. The service creates an unbounded number of detached threads , exhausting system resources such as memory and file d...
CVE-2026-65970
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::readnativescanlines return through an error path while...
CVE-2026-59181
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open...
CVE-2026-10858
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...