CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS v2.22.4 and earlier that allows remote attackers to crash the admin comment interface by submitting malformed payloads. Basic Information Product Vendor: 凌霞软件 Vendor Website:...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...

undici: undici: Denial of Service via unhandled exception in decompress interceptor

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...

undici: undici: Denial of Service via unhandled exception in decompress interceptor

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...

CVE-2026-67418

A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport MQTT message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's...

CVE-2026-42270

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270

The countly-server (the server-side component of Countly) is vulnerable to an unauthenticated Denial of Service (DoS) attack in versions prior to 24.05.50 and 25.03.44 . The root cause is that certain public image and screenshot routes—including star-rating/images/, dashboards/images/screenshots/...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

EUVD-2026-102916

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270: Uncaught Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-87029

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...

rabbitmq-server: rabbitmq-server: Denial of Service via invalid MQTT PUBLISH property

A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport MQTT message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's...

PT-2026-111780

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.2.0 through 5.2.1 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox 4.4 affected versions not specified Description An uncaught exception in the Admin Profile occurs when handling exceptional conditions, which may...

CVE-2026-102413

The Elastic Defend component within Elastic Agent / Endpoint is vulnerable to a Denial of Service (DoS) due to an Uncaught Exception (CWE-248) . When processing a specially crafted file name on Windows hosts using specific system locales (such as Chinese, Japanese, or Korean ), an unhandled excep...

CVE-2026-102413 Uncaught Exception in Elastic Endpoint Leading to Denial of Service

Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations including Chinese, Japanese, and Korean locales on Windows, an unhandle...

Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)

Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations...

PT-2026-107163

Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations including Chinese, Japanese, and Korean locales on Windows, an unhandle...

CVE-2026-86537

A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infini...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the D language bindings. An attacker can cause the application to enter an infinite loop or terminate unexpectedly by sending specially crafted input that triggers an integer underflow or an unhandled exception...