Total
2357 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-74878 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-01 | N/A | 9.8 CRITICAL |
| openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections. | |||||
| CVE-2026-72684 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | N/A | 6.5 MEDIUM |
| A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service. | |||||
| CVE-2026-19617 | 1 Redhat | 3 Enterprise Linux, Hardened Images, Openshift Container Platform | 2026-09-01 | N/A | 5.5 MEDIUM |
| A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems. | |||||
| CVE-2025-4437 | 2026-09-01 | N/A | 5.7 MEDIUM | ||
| There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host. | |||||
| CVE-2026-80179 | 2026-08-31 | N/A | 5.9 MEDIUM | ||
| A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values. | |||||
| CVE-2026-30059 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message. | |||||
| CVE-2026-30070 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-30071 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-30067 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-30063 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query. | |||||
| CVE-2026-30060 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration. | |||||
| CVE-2026-30051 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request. | |||||
| CVE-2026-79661 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3. | |||||
| CVE-2026-74786 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application. | |||||
| CVE-2026-74788 | 2026-08-31 | N/A | 7.5 HIGH | ||
| Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated. | |||||
| CVE-2026-74784 | 2026-08-31 | N/A | N/A | ||
| Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second. | |||||
| CVE-2026-30062 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU. | |||||
| CVE-2026-30057 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request. | |||||
| CVE-2026-30050 | 2026-08-31 | N/A | 7.5 HIGH | ||
| An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request. | |||||
| CVE-2026-3686 | 2026-08-31 | N/A | 6.2 MEDIUM | ||
| IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources. | |||||