CVE-2025-48997

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service DoS by sending an upload file request with an empty string field name. This request causes ...

CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS v2.22.4 and earlier that allows remote attackers to crash the admin comment interface by submitting malformed payloads. Basic Information Product Vendor: 凌霞软件 Vendor Website:...

CVE-2026-119052

A flaw was found in llama.cpp. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted request with an excessively large message length to the Remote Procedure Call RPC server. Handling this malformed input triggers an unhandled exception, crashing the...

Undici Vulnerable To Denial Of Service Via Unhandled Exception In The Decompress Interceptor

Impact undici's "decompress" interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but tha...

Server-side Request Forgery (SSRF)

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatetoolresult function in src/mcp/client/session.py, where $ref references in a tool's output schema are resolved against external registries rather than...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...

undici: undici: Denial of Service via unhandled exception in decompress interceptor

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...

undici: undici: Denial of Service via unhandled exception in decompress interceptor

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...

CVE-2026-67418

A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport MQTT message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's...

CVE-2026-42270

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

EUVD-2026-102916

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270

The countly-server (the server-side component of Countly) is vulnerable to an unauthenticated Denial of Service (DoS) attack in versions prior to 24.05.50 and 25.03.44 . The root cause is that certain public image and screenshot routes—including star-rating/images/, dashboards/images/screenshots/...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270: Uncaught Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-87029

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...