CVE-2026-86537

A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infini...

CVE-2025-70886

CVE-2025-70886 Une preuve de concept PoC pour CVE-2025-70886, une vulnérabilité persistante de déni de service dans Halo CMS v2.22.4 et versions antérieures qui permet à un attaquant distant de planter l'interface de commentaires administrateur en soumettant des charges malformées. Informations d...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

EulerOS Virtualization 2.11.1 : pyOpenSSL (EulerOS-SA-2026-3455)

According to the versions of the pyOpenSSL packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user...

EulerOS Virtualization 2.11.0 : pyOpenSSL (EulerOS-SA-2026-3542)

According to the versions of the pyOpenSSL packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user...

BIT-MONGODB-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path...

Astra Linux – Vulnerability in GIMP

A vulnerability in gimplayerinvalidateboundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception through a crafted XCF file, resulting in a Denial of Service DoS attack...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. In version 4.3.0 , an unhandled TypeError is thrown during output escaping when an async helper (registered via registerAsyncHelper) resolves to an object whose toHTML property is truthy but not callable. Because the async substitution execute...

CVE-2024-58380

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2023-54392

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

CVE-2024-58380 PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

EUVD-2024-55753

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2023-54392 PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

CVE-2024-58380: Improper Input Validation

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2026-82058

MongoDB 's mongod server is vulnerable to a denial-of-service flaw in its JSON Schema validation error generation code. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error path performs an unsafe numeric conversion on t...

CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path...