CWE-400

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automatio

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not r

Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacen

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in sr

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass exis

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send r

The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. P

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedl

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU dispr

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal ha

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression st

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Manage

An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhausti

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS que

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (comp

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Tran

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated qu

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th

A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for t

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in min