Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests w...

CVE-2026-103261

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att

历史摘要 · 未重新核验 · NVD

Tornado before 6.5.9 Denial of Service via Query String

CVE-2026-103261

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att

历史摘要 · 未重新核验 · OSV.dev

Pexip Infinity before 41.0 is affected by improper input validation in the signaling...

CVE-2026-103102

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remot

历史摘要 · 未重新核验 · GitHub Advisory

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web...

CVE-2026-103101

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a ma

历史摘要 · 未重新核验 · GitHub Advisory

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a den...

CVE-2026-103102

CVE-2026-103102 是 Pexip Infinity 视频会议平台的一个高危拒绝服务漏洞，影响 41.0 之前的所有版本。漏洞根源在于信令实现中缺乏严格的输入验证。远程攻击者无需任何认证或用户交互，只需通过 WebRTC 或 A

历史摘要 · 未重新核验 · NVD

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccess...

CVE-2026-103101

该条目来自 NVD 元数据，编号 CVE-2026-103101。受影响产品为 Pexip Infinity 视频会议/协作平台，版本范围覆盖 30.0 起至 40.x，即 41.0 正式发布之前的全部版本。问题根因是其 Web 服务器对输

历史摘要 · 未重新核验 · NVD

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel...

CVE-2026-103042

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_tra

历史摘要 · 未重新核验 · GitHub Advisory

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a...

CVE-2026-86104

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent

历史摘要 · 未重新核验 · NVD

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the syst...

CVE-2026-18105

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, au

历史摘要 · 未重新核验 · NVD

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

CVE-2026-101911

### Summary `new Address6()` and `Address6.isValid()` place no bound on the length of the string they parse. When the s

历史摘要 · 未重新核验 · GitHub Advisory

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhau...

CVE-2026-103042

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_tra

历史摘要 · 未重新核验 · NVD

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

CVE-2026-101917

Summary CVE-2026-48524 (GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid v

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,

历史摘要 · 未重新核验 · GitHub Advisory

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood S...

CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT wi

历史摘要 · 未重新核验 · NVD

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT wi

历史摘要 · 未重新核验 · OSV.dev

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bo...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf

历史摘要 · 未重新核验 · NVD

CVE-2026-102713

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf

历史摘要 · 未重新核验 · OSV.dev

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the st...

CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.st

历史摘要 · 未重新核验 · NVD

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack ca...

CVE-2026-84784

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit

历史摘要 · 未重新核验 · NVD

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more

历史摘要 · 未重新核验 · NVD