Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
CVE-2026-94455
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The a
#cwe-770
共收录 1180 条相关情报。
← 返回所有主题Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
CVE-2026-77633
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs
radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser
CVE-2026-81885
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation f
radare2: Uncontrolled memory allocation in radare2 dmp64 parser
CVE-2026-81886
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoi...
CVE-2026-95666
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length o
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session...
CVE-2026-68956
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote atta
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondar...
CVE-2026-94624
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configur
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses r...
CVE-2026-61652
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issu
vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions
CVE-2026-94624
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configur
Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.
CVE-2026-85219
Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause u
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in...
CVE-2026-93838
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails t
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/...
CVE-2026-57227
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefi...
CVE-2026-93838
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails t
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely...
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dh...
CVE-2026-57224
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with stan...
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri
AnyIO process-pool workers can block indefinitely on undrained stderr
CVE-2026-64847
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redi
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls...
CVE-2026-91149
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustain
AnyIO process-pool workers can block indefinitely on undrained stderr
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri