Phoenix: Unbounded channel joins per transport enables DoS over few connections
CVE-2026-56811
### Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundr
#cwe-770
共收录 1181 条相关情报。
← 返回所有主题amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
CVE-2026-79921
**Summary** A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can for
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
CVE-2026-84778
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
CVE-2026-84776
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the com...
CVE-2026-85107
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFro
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bou...
CVE-2026-71224
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untru
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk d...
CVE-2026-71219
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with a
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
CVE-2026-67446
## Summary Mailpit's thumbnail endpoint decodes attacker-supplied image attachments into a full raster before checking
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the ent...
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel mes...
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the e
A user account with permission to deploy artifacts to a hosted Maven repository could upload a...
CVE-2026-77121
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an ov
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to li...
CVE-2026-77121
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an ov
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdent...
CVE-2026-49249
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
CVE-2026-49249
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Fi...
CVE-2026-78588
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-lev...
CVE-2026-78586
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
CVE-2026-84780
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
CVE-2026-84775
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
## Description ### Summary `parse_multipart_form_data` (httputil.py:34) calls `data.split(b"--"+boundary+b"\r\n")` **b
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only...
CVE-2026-72682
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A