Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on co...

CVE-2026-105297

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set i

历史摘要 · 未重新核验 · NVD

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage...

CVE-2025-36061

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could al

历史摘要 · 未重新核验 · GitHub Advisory

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service us...

CVE-2025-36061

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could al

历史摘要 · 未重新核验 · NVD

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted G...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompr

历史摘要 · 未重新核验 · NVD

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translati...

CVE-2026-112779

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed langua

历史摘要 · 未重新核验 · NVD

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. ...

CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in i

来源摘录 · NVD

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An...

CVE-2026-111064

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handl

来源摘录 · NVD

aiohttp server lacks an initial request/header timeout

CVE-2026-111064

### Summary The keepalive timeout was not used during the initial portion of a request. ### Impact An attacker could

历史摘要 · 未重新核验 · GitHub Advisory

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumpti

历史摘要 · 未重新核验 · GitHub Advisory

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

CVE-2026-111061

### Summary `russh_keys::agent::server::add_key` (`russh/src/keys/agent/server.rs:271-319`) spawns a dedicated tokio ta

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) serv...

CVE-2026-85231

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wra

来源摘录 · NVD

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local ima...

CVE-2026-16251

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of r

来源摘录 · NVD

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification pro...

CVE-2026-19867

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and

来源摘录 · NVD

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file...

CVE-2026-111384

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint be

历史摘要 · 未重新核验 · GitHub Advisory

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows...

CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unb

历史摘要 · 未重新核验 · GitHub Advisory

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

CVE-2026-102682

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Dail

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

CVE-2026-100350

### Summary `openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's

历史摘要 · 未重新核验 · GitHub Advisory

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unau...

CVE-2026-77468

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAP

来源摘录 · NVD

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption...

CVE-2026-110843

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenti

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

CVE-2026-72923

### Impact A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumpt

历史摘要 · 未重新核验 · GitHub Advisory