NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
CVE-2026-46551
### Summary The `uploadViaURL` path in the v1/v2 attachment API did not enforce `NC_ATTACHMENT_FIELD_SIZE` against the
#cwe-770
共收录 1181 条相关情报。
← 返回所有主题An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via cra...
CVE-2026-44070
An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenti
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit...
CVE-2026-8488
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessi
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit...
CVE-2026-8486
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Floodin
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: bef...
CVE-2026-8488
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessi
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.1...
CVE-2026-8486
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Floodin
Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service
CVE-2026-8468
### Summary An Allocation of Resources Without Limits or Throttling vulnerability in `Plug.Conn.read_part_headers/2` al
Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. M...
CVE-2026-8469
Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthentic
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A rem...
CVE-2026-9064
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an uppe
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sendi...
CVE-2026-41292
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsin
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerabili...
CVE-2025-57798
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.1
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
CVE-2026-45802
### Impact This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-s
Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable system to generat...
CVE-2026-45557
Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in con
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an una...
CVE-2026-33232
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
CVE-2026-45554
### Summary Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may r
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
CVE-2026-45682
### Summary The custom `CappedConcurrentHashMap` introduced for Java TLS state tracking never removes keys from its ins
ImageMagick: Policy Bypass in PSD decoder
CVE-2026-45031
Due to a missing check in the PSD decoder it would be possible to bypass the `list-length` resource policy when decoding
iskorotkov/avro: Denial-of-Service Vulnerability in Decoder
# Memory Exhaustion via Unbounded Map Allocations in Avro Decoder ## Summary The Avro map decoder accepted attacker-co
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the...
CVE-2026-2325
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body o
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authent...
CVE-2026-2325
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body o