Denial of Service (DoS) - 39647 CVEs (Page 6/331)

About “Denial of Service (DoS)”

A curated feed of “Denial of Service (DoS)”-related CVEs appears below. We currently track 39647 CVEs for this tag (all time). In the last 365 days, 3219 were published. Average CVSS is 6.6 (all time; 6.6 over 365d), and 47% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-400 - Uncontrolled Resource Consumption, CWE-770 - Allocation of Resources Without Limits or Throttling, CWE-476 - NULL Pointer Dereference.

In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2026-04-22

High

CVE-2026-31476

In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the erro…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2026-33601

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to…

CVSS: 4.4 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2026-33600

An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVSS: 4.4 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2026-33262

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.

CVSS: 5.9 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2026-33261

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

CVSS: 5.9 CWE: CWE-353 - Missing Support for Integrity Check View on NVD

Medium

CVE-2026-33260

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS: 5.3 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

Medium

CVE-2026-33257

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS: 5.3 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

Medium

CVE-2026-33256

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS: 5.3 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

High

CVE-2026-6846

A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker c…

CVSS: 7.8 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

Medium

CVE-2026-6845

A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially c…

CVSS: 5.0 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2026-6844

A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable…

CVSS: 5.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-6843

A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application…

CVSS: 5.5 CWE: CWE-134 - Use of Externally-Controlled Format String View on NVD

Medium

CVE-2026-2717

The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields bef…

CVSS: 5.5 CWE: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection') View on NVD

High

CVE-2026-41458

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized acces…

CVSS: 8.2 CWE: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') View on NVD

High

CVE-2026-41135

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

2026-04-21

Low

CVE-2026-35250

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privilege…

CVSS: 2.3 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35248

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privile…

CVSS: 5.0 CWE: CWE-284 - Improper Access Control View on NVD

High

CVE-2026-35245

CVSS: 7.5 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35240

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vuln…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35239

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerabil…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35238

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability a…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35237

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35236

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35235

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged atta…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-35234

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privilege…

CVSS: 4.9 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34325

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affec…

CVSS: 6.8 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34323

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily ex…

CVSS: 6.3 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34319

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vuln…

CVSS: 5.0 CWE: CWE-204 - Observable Response Discrepancy View on NVD

Medium

CVE-2026-34317

CVSS: 5.0 CWE: CWE-404 - Improper Resource Shutdown or Release View on NVD

Medium

CVE-2026-34308

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerabi…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34304

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34303

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34302

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows…

CVSS: 5.5 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34298

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulner…

CVSS: 4.7 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34293

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged att…

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2026-34290

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2026-34282

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34281

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker wi…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34278

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileg…

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34277

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allo…

CVSS: 6.6 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2026-34276

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily e…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34272

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34271

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34270

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-34267

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22021

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8…

CVSS: 5.3 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Low

CVE-2026-22018

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java…

CVSS: 3.7 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

Medium

CVE-2026-22017

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22009

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22005

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22004

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22003

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u481 and 8u481-b50;…

CVSS: 6.0 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-22002

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-21998

CVSS: 4.9 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2026-24189

NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request. A successful exploit of this vulne…

CVSS: 8.2 CWE: CWE-125 - Out-of-bounds Read View on NVD

Critical

CVE-2026-40498

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators.…

CVSS: 9.8 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2026-29644

XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal C…

CVSS: 5.3 CWE: CWE-284 - Improper Access Control View on NVD

High

CVE-2025-13826

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attac…

CVSS: 8.2 CWE: CWE-20 - Improper Input Validation View on NVD

Medium

CVE-2026-6058

** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to…

CVSS: 4.5 CWE: CWE-116 - Improper Encoding or Escaping of Output View on NVD

High

CVE-2026-39320

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

2026-04-20

High

CVE-2026-29643

XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper exceptional-condition handling flaw in its CSR subsystem (N…

CVSS: 7.1 CWE: CWE-703 - Improper Check or Handling of Exceptional Conditions View on NVD

Critical

CVE-2026-29646

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can inf…

CVSS: 9.8 CWE: CWE-267 - Privilege Defined With Unsafe Actions View on NVD

High

CVE-2026-5478

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files…

CVSS: 8.1 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

Critical

CVE-2026-29649

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode w…

CVSS: 9.8 CWE: CWE-693 - Protection Mechanism Failure View on NVD

High

CVE-2026-29645

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decodin…

CVSS: 7.5 CWE: CWE-131 - Incorrect Calculation of Buffer Size View on NVD

Medium

CVE-2026-6060

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS…

CVSS: 4.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-32961

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing a crafted packet may cause a temporary…

CVSS: 5.3 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

2026-04-18

High

CVE-2026-40489

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allo…

CVSS: 8.6 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

Medium

CVE-2026-40347

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or…

CVSS: 5.3 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-40337

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task…

CVSS: 5.1 CWE: CWE-283 - Unverified Ownership View on NVD

2026-04-17

High

CVE-2026-40481

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe sig…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Critical

CVE-2026-5720

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPActio…

CVSS: 9.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

Critical

CVE-2026-33689

xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger…

CVSS: 9.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

Critical

CVE-2026-33516

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before valida…

CVSS: 9.1 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2026-32624

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrd…

CVSS: 6.5 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

High

CVE-2026-32623

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the mo…

CVSS: 8.1 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

Medium

CVE-2026-28214

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when…

CVSS: 6.5 CWE: CWE-190 - Integer Overflow or Wraparound View on NVD

Medium

CVE-2025-70795

STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party impl…

CVSS: 5.5 CWE: CWE-269 - Improper Privilege Management View on NVD

High

CVE-2026-6507

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server config…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

2026-04-16

High

CVE-2026-40308

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied argument…

CVSS: 8.8 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

High

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks int…

CVSS: 8.7 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

Medium

CVE-2025-43935

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnera…

CVSS: 4.4 CWE: CWE-404 - Improper Resource Shutdown or Release View on NVD

High

CVE-2026-33083

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoint…

CVSS: 8.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

Medium

CVE-2025-43883

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker with local access could potentially explo…

CVSS: 4.1 CWE: CWE-754 - Improper Check for Unusual or Exceptional Conditions View on NVD

High

CVE-2026-6409

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or dee…

CVSS: 7.1 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2024-2374

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft…

CVSS: 7.5 CWE: CWE-611 - Improper Restriction of XML External Entity Reference View on NVD

2026-04-15

High

CVE-2026-40192

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attac…

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-6385

A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability i…

CVSS: 6.5 CWE: CWE-190 - Integer Overflow or Wraparound View on NVD

High

CVE-2026-6384

A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's `ReadJeffsImage` function allows an attacker to write beyond an allocated buffer by processing a spec…

CVSS: 7.3 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

Medium

CVE-2026-40919

A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted Seattle Filmworks file. A remote attacke…

CVSS: 6.1 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2026-40918

A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack-based buffer overflow and an out-of-bou…

CVSS: 5.5 CWE: CWE-131 - Incorrect Calculation of Buffer Size View on NVD

Medium

CVE-2026-40916

A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM…

CVSS: 5.0 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2026-40915

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-…

CVSS: 5.5 CWE: CWE-190 - Integer Overflow or Wraparound View on NVD

Medium

CVE-2026-6245

A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Be…

CVSS: 5.5 CWE: CWE-805 - Buffer Access with Incorrect Length Value View on NVD

Medium

CVE-2026-5758

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve…

CVSS: 6.5 CWE: N/A View on NVD

Critical

CVE-2026-20186

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploi…

CVSS: 9.9 CWE: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection') View on NVD

Critical

CVE-2026-20180

CVSS: 9.9 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

Critical

CVE-2026-20147

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vu…

CVSS: 9.9 CWE: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection') View on NVD

Medium

CVE-2026-1509

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()`…

CVSS: 5.4 CWE: CWE-94 - Improper Control of Generation of Code ('Code Injection') View on NVD

2026-04-14

Medium

CVE-2026-35034

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authent…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

Medium

CVE-2026-39811

A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions…

CVSS: 4.9 CWE: CWE-190 - Integer Overflow or Wraparound View on NVD

Medium

CVE-2026-2405

CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /he…

CVSS: 6.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

2026-04-13

Medium

CVE-2026-33947

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by…

CVSS: 6.2 CWE: CWE-674 - Uncontrolled Recursion View on NVD

High

CVE-2026-33908

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyX…

CVSS: 7.5 CWE: CWE-674 - Uncontrolled Recursion View on NVD

Medium

CVE-2026-31280

An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (DoS) via supplying crafted RFCOMM frames.

CVSS: 6.5 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

High

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

High

CVE-2026-30999

A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS: 7.5 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

High

CVE-2026-30998

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.

CVSS: 7.5 CWE: CWE-400 - Uncontrolled Resource Consumption View on NVD

High

CVE-2026-30997

An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS: 7.5 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2026-29628

A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (DoS) via supplying a crafted .mtl file.

CVSS: 6.2 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

Medium

CVE-2026-31415

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel b…

CVSS: 5.5 CWE: CWE-617 - Reachable Assertion View on NVD

Medium

CVE-2026-25204

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 9…

CVSS: 6.2 CWE: CWE-502 - Deserialization of Untrusted Data View on NVD

2026-04-12

Medium

CVE-2026-40396

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session r…

CVSS: 4.0 CWE: CWE-670 - Always-Incorrect Control Flow Implementation View on NVD

Medium

CVE-2026-40395

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req…

CVSS: 4.0 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

Medium

CVE-2026-40394

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 sess…

CVSS: 4.0 CWE: CWE-670 - Always-Incorrect Control Flow Implementation View on NVD

Medium

CVE-2019-25712

BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field that allows local attackers to crash the application by submitting an oversized key value. Attackers can tri…

CVSS: 6.2 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2019-25711

SpotFTP Password Recover 2.4.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized buffer in the Name field during registration.…

CVSS: 6.2 CWE: CWE-807 - Reliance on Untrusted Inputs in a Security Decision View on NVD

2026-04-10

Medium

CVE-2026-27460

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import function…

CVSS: 6.5 CWE: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification) View on NVD

High

CVE-2026-40074

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter c…

CVSS: 7.5 CWE: CWE-755 - Improper Handling of Exceptional Conditions View on NVD

Medium

CVE-2026-6067

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling…

CVSS: 5.5 CWE: CWE-787 - Out-of-bounds Write View on NVD