Export limit exceeded: 404236 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (8220 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19645 | 1 Ibm | 1 Mq Agent | 2026-09-10 | 6.5 Medium |
| IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature. | ||||
| CVE-2026-70065 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-10 | 7.5 High |
| Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69405 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-10 | 5.7 Medium |
| Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-69497 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-10 | 6.5 Medium |
| Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-69781 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-09-10 | 6.5 Medium |
| Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-83968 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-10 | 7.8 High |
| Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-41869 | 1 Apache | 1 Nutch | 2026-09-10 | 9.1 Critical |
| Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ . | ||||
| CVE-2026-87822 | 1 Tdunning | 1 T-digest | 2026-09-10 | 7.5 High |
| t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations. | ||||
| CVE-2026-73786 | 1 Hewlett Packard Enterprise (hpe) | 1 Clearpass Policy Manager (cppm) | 2026-09-10 | 7.5 High |
| A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server. | ||||
| CVE-2026-88286 | 1 Geovision Inc. | 1 Gv-lpc2011 Lpc2211 | 2026-09-10 | 7.5 High |
| GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections. | ||||
| CVE-2026-18076 | 1 Ibm | 1 I | 2026-09-10 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak. | ||||
| CVE-2023-54395 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 4.3 Medium |
| PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections. | ||||
| CVE-2026-88290 | 1 Geovision Inc. | 1 Gv-lpc2011 Lpc2211 | 2026-09-10 | 7.5 High |
| GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources. | ||||
| CVE-2026-86432 | 1 Thephpleague | 1 Commonmark | 2026-09-10 | 5.3 Medium |
| commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources. | ||||
| CVE-2026-86734 | 2 Grokability, Snipeitapp | 2 Snipe-it, Snipe-it | 2026-09-10 | 6.5 Medium |
| Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline. | ||||
| CVE-2026-86202 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 4.3 Medium |
| PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources. | ||||
| CVE-2026-86204 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 6.5 Medium |
| PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive. | ||||
| CVE-2025-71418 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 5.3 Medium |
| PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints. | ||||
| CVE-2026-47888 | 2 Spring, Vmware | 2 Spring Framework, Spring Framework | 2026-09-10 | 7.5 High |
| A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE | ||||
| CVE-2026-47886 | 2 Spring, Vmware | 2 Spring Framework, Spring Framework | 2026-09-10 | 7.5 High |
| Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||