Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression...
CVE-2026-74785
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass exis
#cwe-400
共收录 1383 条相关情报。
← 返回所有主题stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing...
CVE-2026-73057
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause deni
OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packa...
CVE-2026-74797
OpenTofu 1.11.4之前版本中的`tofu init`命令在处理用于provider或module包的恶意构造的.zip归档文件时存在拒绝服务（Denial of Service, DoS）漏洞。该漏洞源于对zip归档内容的处理缺
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and f...
CVE-2026-74789
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expe
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplicat...
CVE-2026-74785
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass exis
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host ma...
CVE-2026-73057
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause deni
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the ...
CVE-2026-18549
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, w
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitte...
CVE-2026-73634
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Con
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin r...
CVE-2026-73633
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured t
A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipu...
CVE-2026-19830
A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of th
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVE-2026-33818
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to...
CVE-2026-17078
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
CVE-2026-17078
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
vLLM: Completion prompt lists fan out into unbounded engine requests
CVE-2026-73559
## Summary The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an at...
CVE-2026-73568
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming()
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path...
CVE-2026-73566
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListene...
CVE-2026-73561
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSoc
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/comple...
CVE-2026-73559
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforce...
CVE-2026-73556
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to pres...
CVE-2026-73507
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.