CWE-770

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords,

IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to impr

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 1

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dic

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that a

OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Go

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applicat

DeepDiff is a project focused on Deep Difference and search of any Python data. From version 5.0.0 to before version 8.6

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` en

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to v

Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files()

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume e

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory cra

Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoint

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Fina

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-sec

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `_

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient re

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DN

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with

Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via mul

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only w

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8,

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or u

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezv

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extractio

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cert

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection c

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query b

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can i

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote a

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The se

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The se

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call modu

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. A

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the B

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel