AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
CVE-2026-82722
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can rea
#cwe-770
共收录 1181 条相关情报。
← 返回所有主题Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity ...
CVE-2026-81636
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
CVE-2026-81636
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated
### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an a...
CVE-2026-82562
该漏洞存在于 Node.js 的 qs 查询字符串解析库（版本 >=6.14.2 <6.16.0）。当调用方以 `comma: true` 和 `throwOnLimitExceeded: true` 选项解析不可信的查询字符串或 urle
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of...
CVE-2026-3686
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limi
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation...
CVE-2026-73108
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.
CVE-2026-3686
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limi
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate...
CVE-2026-54788
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CVE-2026-81285
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An ...
CVE-2026-58107
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib d
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2026-37736
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of
Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun
CVE-2026-58107
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib d
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can forc...
CVE-2026-80179
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
CVE-2026-59303
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cl
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion...
CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.creat...
CVE-2026-80212
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource:
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could l...
CVE-2026-5680
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
CVE-2026-30062
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
CVE-2026-30057
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS)
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a ...
CVE-2026-30050
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows atta