yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
CVE-2026-107840
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and
#cwe-400
共收录 1360 条相关情报。
← 返回所有主题yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-cont...
CVE-2026-107840
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 PO...
CVE-2026-107839
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes...
CVE-2026-107834
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multip
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
CVE-2026-107840
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
CVE-2026-107839
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age
OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
CVE-2026-107834
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multip
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads ...
CVE-2026-48484
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
CVE-2026-48484
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controll...
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication pat
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication pat
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_w...
CVE-2026-107727
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscriptio
Strawberry legacy graphql-ws retains naturally completed subscription slots
CVE-2026-107727
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscriptio
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
CVE-2026-95116
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/bl
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd...
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
CVE-2026-107391
### Summary `StsdAtom.get()` in `lib/mp4/AtomToken.ts` parses an MP4 `stsd` (sample description) box's entry table by a
IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-c...
CVE-2026-84276
IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthen
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
CVE-2026-105749
### Summary The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table `rowspan` / `colspan` valu
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a...
CVE-2026-93679
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to un
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33...
CVE-2026-84897
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M