By weakness (CWE)

CWE-400: related vulnerabilities

CVEs classified under CWE-400. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

171 published vulnerabilities · page 2 of 2

• CVE-2026-36605MEDIUM 6.5

  Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909 contain a denial-of-service vulnerability where an attacker on the local network can send a small number of specially crafted incomplete HTTP requests to crash the router. The device becomes unresponsive and requires a physical power cycle to restore function. This affects network availability for all connected devices.

• CVE-2026-36724MEDIUM 6.5

  FastapiAdmin version 2.2.0 contains a flaw in its scheduled task management endpoint that allows authenticated users with appropriate permissions to crash the application by submitting malformed task data. An attacker who has legitimate access and the module_task:job:update permission can trigger an unhandled exception that disrupts service availability.

• CVE-2026-39197MEDIUM 6.5

  Vector v0.54.0, Datadog's lightweight observability pipeline tool, contains a vulnerability in its HTTP utility module that allows authenticated attackers to send specially crafted requests that crash or hang the service, disrupting data collection and processing. An attacker with valid credentials can trigger a denial-of-service condition without needing special privileges or user interaction.

• CVE-2026-42073MEDIUM 6.5

  OpenClaude, an open-source command-line tool for interacting with cloud and local AI models, has a flaw in how it handles user login. When you authenticate using OAuth, the software runs a temporary web server locally to catch the login response. To prevent attackers from hijacking this process, the server checks a security token called a 'state parameter.' However, due to a bug in how the code checks this token, an attacker can bypass the security check entirely and crash the server without even knowing what the token is. This has been fixed in version 0.5.1 and later.

• CVE-2026-42399MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic access to crash the application by uploading specially crafted visualizations. An attacker submits a Timelion visualization with deeply nested function calls that causes Kibana to allocate memory without limit, eventually consuming all available RAM and taking the service offline for everyone. This is a denial-of-service attack that requires valid credentials but no administrative privileges.

• CVE-2026-42400MEDIUM 6.5

  CVE-2026-42400 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze a Kibana instance by sending a malicious compressed request. The vulnerability exists because Kibana processes and decompresses incoming requests before fully validating user permissions, meaning an attacker can consume excessive memory and CPU resources on the server before authorization checks can stop them. While this requires valid credentials to exploit, the impact is straightforward: a Kibana instance can become unresponsive or crash entirely, disrupting visibility and analysis capabilities that teams depend on.

• CVE-2026-44645MEDIUM 6.5

  LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, contains a denial-of-service vulnerability in versions 10.25.7 and below. The vulnerability allows an attacker with the ability to write templates to bypass the renderLimit protection mechanism—a feature designed to prevent templates from consuming excessive CPU time. By crafting a template with an empty for loop or tablerow block, an attacker can force a single render operation to consume far more time than the configured limit allows, potentially freezing application threads and disrupting service availability. This is particularly dangerous in multi-tenant environments where untrusted users can author templates.

• CVE-2026-44796MEDIUM 6.5

  Nautobot, a network automation and source-of-truth platform, contains a denial-of-service vulnerability in its bulk-rename feature. An authenticated attacker can craft malicious regular expressions in the 'find' field and enable the regex flag to cause the application to hang or become unresponsive, disrupting access for all users. The flaw affects versions before 2.4.33 and 3.1.2.

• CVE-2026-45149MEDIUM 6.5

  The brace-expansion library, a utility for generating string sequences from patterns, has a performance handling flaw in versions 5.0.0 through 5.0.5. When users expand large numeric ranges—such as {1..10000000}—the library was constructing the entire intermediate sequence in memory before applying user-defined limits. This means even if you set a maximum output of 10 items, the library would still build all 10 million elements first, consuming roughly 505 MB of memory and 800 milliseconds of processing time before discarding them. The flaw is fixed in version 5.0.6 and later.

• CVE-2026-48208MEDIUM 6.5

  OTRS and OTRS Community Edition contain a vulnerability that allows attackers to embed malicious SVG (Scalable Vector Graphics) code within email messages sent to the ticketing system. When an agent or customer opens an affected ticket, the crafted SVG content can consume excessive browser resources, rendering the application unresponsive or forcing a browser crash. This is a denial-of-service attack that requires no special privileges and occurs automatically when viewing a compromised ticket—the attacker simply needs to send an email to the OTRS system.

• CVE-2026-49090MEDIUM 6.5

  An authenticated user in Elasticsearch can submit a specially crafted bulk request that causes a denial of service by forcing sustained high CPU consumption on the affected node. The node becomes unable to process legitimate requests, effectively taking it offline without requiring any special access privileges or user interaction. While this requires valid credentials to execute, it can disrupt availability across your infrastructure.

• CVE-2026-49094MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic viewer access to cause the service to become unavailable by submitting specially crafted requests to analytics collection endpoints. When Kibana processes these requests, it exhausts system CPU and memory resources, forcing administrators to manually restart the service to restore availability. The attacker does not need elevated permissions—standard viewer-level credentials are sufficient to trigger the denial of service.

• CVE-2026-50212MEDIUM 6.5

  CVE-2026-50212 is a denial-of-service vulnerability in Acer Connect M6E 5G devices that allows an attacker on the same network segment to remotely disconnect other users' devices without authorization. The flaw stems from inadequate validation in the device dissociation API—the mechanism that normally unbinds user endpoints from the network. An attacker can exploit this to force legitimate users offline, disrupting service availability. No authentication is required, and the attack succeeds with minimal complexity.

• CVE-2026-54092MEDIUM 6.5

  File Browser versions prior to 2.63.6 contain a denial-of-service vulnerability in the login API that accepts arbitrarily large passwords without validation. An authenticated attacker can submit an extremely long password string, causing the application to consume excessive CPU and memory resources, leading to service degradation or complete failure. In containerized environments, this can crash the container, severely impact host system performance, and potentially trigger errors in the Docker daemon itself.

• CVE-2026-55646MEDIUM 6.5

  vLLM versions 0.22.0 through 0.23.0 contain a denial-of-service vulnerability in their audio transcription and translation API endpoints. When a user uploads an audio file to these routes, the system reads the entire file into memory before checking whether it exceeds the configured size limit. An authenticated attacker can exploit this by uploading an extremely large audio file, forcing vLLM to consume massive amounts of memory during processing. Depending on how the service is deployed, this can cause severe memory pressure, trigger out-of-memory errors, or crash the vLLM process entirely. The vulnerability was patched in version 0.24.0.

• CVE-2026-57204MEDIUM 6.5

  pypdf, a widely-used open-source Python library for working with PDF files, contains a denial-of-service vulnerability that allows an attacker to craft a malicious PDF capable of consuming excessive memory on systems that parse it. The flaw stems from the library's failure to properly enforce memory limits when processing PDF content streams that lack explicit length declarations. An attacker would need to trick a user into opening or processing such a PDF, but once they do, the parsing operation can exhaust available memory and crash or severely degrade the affected application.

• CVE-2026-57914MEDIUM 6.5

  Apache Kerby, a Kerberos protocol implementation, contains a vulnerability where specially crafted deeply nested ASN.1 structures can cause a stack overflow, crashing the affected service or client. This results in a denial-of-service condition that prevents legitimate users from accessing the service. The vulnerability requires an authenticated user to exploit, meaning an attacker must already have valid credentials or network access to send the malicious message.

• CVE-2026-9002MEDIUM 6.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a vulnerability that allows attackers on the same network to crash the application server. The flaw exists in how the system handles deeply nested Protocol Buffers messages without proper size limits, enabling an attacker to exploit this by sending specially crafted network packets that cause the Java Virtual Machine to run out of memory or exhaust the call stack, bringing down the service.

• CVE-2026-47902MEDIUM 6.2

  CAI Content Credentials, Adobe's implementation of Content Provenance and Authentication, contains a flaw that allows attackers to consume excessive system resources without any user action required. This can crash or severely degrade applications using affected versions of the c2pa-web library (0.7.1 and earlier) or the c2pa core library (v0.80.1 and earlier). The vulnerability is a resource exhaustion issue—an attacker sends specially crafted input that forces the application to allocate memory or processing power until the system becomes unresponsive.

• CVE-2026-47904MEDIUM 6.2

  CAI Content Credentials, a component used for managing digital content authenticity and provenance, contains a flaw that allows an attacker to consume excessive system resources without requiring user action. An affected application could become unresponsive or crash, effectively denying legitimate users access to the service. This is a local-level vulnerability, meaning an attacker needs some degree of system access to trigger the condition.

• CVE-2026-47905MEDIUM 6.2

  A resource exhaustion vulnerability exists in Adobe's Content Credentials (C2PA) library that allows an attacker to consume excessive system resources and crash an application without requiring any user action. The vulnerability affects C2PA Web version 0.7.1 and earlier, as well as C2PA version 0.80.1 and earlier. An unauthenticated attacker with local access could trigger the issue remotely through the affected library, leading to a denial-of-service condition.

• CVE-2026-50171MEDIUM 6.1

  Angular applications using number formatting features are vulnerable to a denial-of-service attack if an attacker can control the formatting instructions passed to number-display functions. An attacker crafting specially designed format strings with extremely large digit specifications can cause the application to enter an infinite loop that consumes memory and CPU, effectively freezing or crashing the app. This affects Angular's number, decimal, percent, and currency formatting pipes—features commonly used to display financial data, statistics, and user-facing numbers.

• CVE-2026-41711MEDIUM 5.9

  Spring Data Commons, a widely-used data access library in the Spring ecosystem, contains a flaw in how it processes Sort parameters. An attacker can craft malicious Sort requests that cause applications to exhaust stack memory, crashing the service. This is a network-accessible denial-of-service vulnerability that requires no authentication or user interaction—any exposed endpoint accepting Sort parameters becomes an attack surface.

• CVE-2026-41721MEDIUM 5.9

  Spring Data Commons, a widely-used data access abstraction framework, contains a vulnerability that enables remote denial-of-service attacks. When Spring Data Web Support is enabled and a controller uses the @ProjectedPayload annotation, attackers can craft specific HTTP requests that force the application to consume excessive memory, degrading or halting service availability. The vulnerability requires specific configuration conditions to be present, limiting its immediate exposure but posing real risk to affected deployments.

• CVE-2026-45680MEDIUM 5.9

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a performance degradation vulnerability in their metrics collection pipeline. When systems experience high activity, the instrumentation replays recorded probe hits by iterating once per run count. On busy infrastructure, this run-count delta can grow very large, forcing the metrics exporter into a computationally expensive tight loop during each collection interval. The result is excessive CPU consumption that can degrade system performance. This is a denial-of-service condition rather than a confidentiality or integrity breach, but it directly impacts availability and operational efficiency.

• CVE-2026-9320MEDIUM 5.9

  IBM WebSphere Application Server versions 9.0 and 8.5, along with WebSphere Liberty versions 17.0.0.3 through 26.0.0.6, contain a denial-of-service vulnerability triggered by specially-crafted network requests. An attacker can exploit this remotely without authentication to exhaust server memory, causing service degradation or outages. The vulnerability does not compromise confidentiality or integrity—its impact is purely on availability.

• CVE-2026-47734MEDIUM 5.7

  Dulwich is a Python library used by Git servers to handle code push operations. A vulnerability in versions before 1.2.5 allows an attacker with push access to craft a specially designed small Git package that tricks the server into allocating hundreds of megabytes of memory based on false size declarations in the package header. This memory exhaustion attack can degrade or crash the server, denying legitimate developers access to the repository.

• CVE-2026-48187MEDIUM 5.7

  OTRS has a vulnerability in its email handling system that allows authenticated users to trigger excessive resource allocation on the web server, potentially causing it to crash or become unresponsive. An attacker with valid login credentials can exploit this through user interaction to exhaust server resources, resulting in denial of service. This is not a critical vulnerability but poses a meaningful availability risk to organizations relying on OTRS for ticketing operations.

• CVE-2025-48648MEDIUM 5.5

  CVE-2025-48648 is a denial-of-service vulnerability in Android's NotificationManagerService that allows a local attacker to exhaust system resources and crash the notification service. An attacker with basic user privileges can trigger this flaw without user interaction, causing persistent disruption to the device's notification functionality.

• CVE-2026-0042MEDIUM 5.5

  CVE-2026-0042 is a resource exhaustion vulnerability in Google Android's UBSan runtime component that allows a local attacker to cause a persistent denial of service. An attacker with basic user-level access can trigger the flaw without user interaction, exhausting system resources and rendering the device unavailable. The vulnerability does not enable unauthorized access or data theft—only availability disruption.

• CVE-2026-0064MEDIUM 5.5

  CVE-2026-0064 is a resource exhaustion vulnerability affecting Google Android that allows a locally authenticated attacker to cause a persistent denial of service. The vulnerability exists in multiple code paths and requires only standard user privileges to trigger—no special permissions or user interaction are needed. Once exploited, the affected system can be rendered unresponsive or unstable until remediated.

• CVE-2026-0069MEDIUM 5.5

  CVE-2026-0069 is a resource exhaustion vulnerability in Android's signature verification code that allows a local attacker to crash the system without needing special privileges or user interaction. An attacker with basic local access can trigger excessive resource consumption in the APK checksum verification process, causing a denial of service.

• CVE-2026-0074MEDIUM 5.5

  CVE-2026-0074 is a denial-of-service vulnerability in Android's LauncherProcessImageListener component. An attacker with local system access can exhaust device resources through the getPreferredSize function, causing the launcher process to become unresponsive or crash. No special privileges or user interaction are required to trigger the flaw, making it a concern for multi-user devices and environments where untrusted code may run locally.

• CVE-2026-28575MEDIUM 5.5

  A logic error in Android's package installation code allows a locally authenticated attacker to exhaust device memory, causing the system to become unresponsive or crash. The vulnerability exists in how the system handles file transfers during app installation and requires only local access—no special permissions or user interaction needed to trigger the denial of service.

• CVE-2026-47262MEDIUM 5.5

  containerd, the widely-used container runtime that powers Docker and Kubernetes, has a memory exhaustion vulnerability that can crash the entire runtime. A specially crafted container image can trigger the vulnerability when the container is created, causing memory to be consumed until the containerd process runs out of memory and is killed by the operating system. This knocks the container runtime offline, breaking both container orchestration and any applications depending on it. The flaw affects containerd versions before 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2.

• CVE-2026-48155MEDIUM 5.5

  pypdf, a popular open-source PDF processing library, contains a denial-of-service vulnerability affecting versions prior to 6.12.0. An attacker can craft a malicious PDF file that, when processed by pypdf's text extraction feature in layout mode, triggers excessive memory consumption. This occurs specifically when the PDF contains large character offsets. The flaw does not compromise data confidentiality or integrity, but can render systems unresponsive or crash applications that depend on pypdf for PDF handling.

• CVE-2026-49461MEDIUM 5.5

  CVE-2026-49461 is a denial-of-service vulnerability in pypdf, a widely-used Python library for PDF processing. An attacker can craft a malicious PDF file that causes excessive memory consumption when a user or application extracts text from a page containing a specially-constructed form XObject with self-referential loops. This does not allow data theft or system compromise, but can exhaust memory resources and crash applications that depend on pypdf. The vulnerability is resolved in version 6.12.2.

• CVE-2026-10224MEDIUM 5.3

  A vulnerability in NousResearch's hermes-agent allows an attacker to consume resources on a server by sending specially crafted requests to a webhook endpoint. The vulnerability affects versions up to 2026.4.30 and can be triggered remotely without authentication. While the technical complexity is low, the impact is limited to availability rather than data breach or system compromise. Public exploit information exists, though NousResearch has not responded to early vendor disclosure attempts.

• CVE-2026-10650MEDIUM 5.3

  A flaw in libwebsockets (a widely-used WebSocket and networking library) allows attackers to exhaust server resources by manipulating a specific message length parameter in the SSH protocol handler. The vulnerability requires network access but no authentication, and an exploit has already been published. This is a denial-of-service issue that can make affected systems unresponsive without compromising data confidentiality or integrity.

• CVE-2026-45031MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing tool, contains a vulnerability in its PSD (Photoshop) file decoder that allows an attacker to circumvent resource limits designed to prevent denial-of-service attacks. By crafting a malicious PSD file, an attacker can cause excessive resource consumption during image decoding, potentially disrupting services that rely on ImageMagick to process untrusted image uploads. The vulnerability affects versions prior to 6.9.13-47 and 7.1.2-22, and patches are now available.

• CVE-2026-45664MEDIUM 5.3

  ImageMagick, a widely-used tool for image processing and manipulation, has a vulnerability in its MNG (Multiple-Image Network Graphics) file handler that allows an attacker to bypass resource limits. By crafting a malicious MNG file with more images than the system's policy allows, an attacker can trigger excessive resource consumption—potentially causing performance degradation or denial of service. The vulnerability affects ImageMagick versions before 6.9.13-47 and 7.1.2-22, and has been resolved in those patch versions.

• CVE-2026-46843MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an attacker without credentials to trigger a partial denial of service over the network via HTTPS. The vulnerability is in the Core component and requires no special user interaction. An attacker can exploit this remotely to degrade availability of the REST Data Services instance, though data confidentiality and integrity are not at risk.

• CVE-2026-47244MEDIUM 5.3

  Netty, a widely-used framework for building network applications and HTTP/2 servers, has a flaw in how it manages concurrent HTTP/2 streams. By default, Netty does not enforce a limit on the number of concurrent streams a client can open on a single connection, allowing an attacker to exhaust server resources by opening hundreds of thousands of stream objects. This vulnerability becomes especially dangerous when combined with Rapid-Reset-style attacks, where attackers can amplify their impact by rapidly opening and closing many streams.

• CVE-2026-47706MEDIUM 5.3

  Strawberry GraphQL versions 0.71.0 through 0.315.6 contain a denial-of-service vulnerability in the QueryDepthLimiter extension. An attacker can craft a GraphQL query with circular fragment references that causes the validation process to enter infinite recursion, crashing the server. This affects any GraphQL API built with vulnerable Strawberry versions. The issue is resolved in version 0.315.7.

• CVE-2026-47707MEDIUM 5.3

  Strawberry GraphQL, a Python library for building GraphQL APIs, contains a flaw in its MaxAliasesLimiter security extension that allows attackers to bypass protective limits on query aliases. The vulnerability exists because the extension counts static aliases correctly but fails to account for how fragment spreads multiply and amplify those aliases during execution. An attacker can craft a malicious GraphQL query using fragment spreads to force the server to resolve far more aliases than the configured limit permits, exhausting server resources and causing a denial of service. The issue affects versions 0.172.0 through 0.315.6; version 0.315.7 and later contain the fix.

• CVE-2026-48043MEDIUM 5.3

  Netty's HTTP/2 decompression logic has a resource leak that can exhaust memory and crash the JVM. When a remote attacker sends specially crafted HTTP/2 frames, the decompressor fails to properly release memory buffers, and repeated exploitation can lead to out-of-memory errors. This affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-48525MEDIUM 5.3

  PyJWT, a widely-used Python library for JSON Web Token (JWT) handling, contains a denial-of-service vulnerability in its handling of detached JWS (JSON Web Signature) tokens. When processing tokens with the unencoded-payload option enabled (RFC 7797's b64=false mode), the library decodes the Base64URL-encoded payload segment before applying detached-payload verification rules. An attacker can exploit this by sending a specially crafted token with an extremely large payload segment, forcing the library to perform unnecessary decoding and memory allocation even before signature validation occurs. This creates a resource exhaustion attack that can be triggered by unauthenticated remote clients against any application using PyJWT to verify detached JWS tokens.

• CVE-2026-48937MEDIUM 5.3

  Node.js HTTP/2 servers have a flaw where they continue processing incoming data even after sending a GOAWAY frame—a signal that should cleanly terminate the connection. This causes servers to accept and process requests they should have already rejected, potentially leading to resource exhaustion. Node.js 22 and 24 are affected. The vulnerability is not currently known to be exploited in the wild.

• CVE-2026-48988MEDIUM 5.3

  markdown-it, a widely-used Markdown parser, contains a denial-of-service vulnerability in versions 14.1.1 and earlier when the typographer feature is enabled. When processing Markdown text with many quotation marks, the parser consumes excessive CPU due to inefficient string manipulation, potentially allowing an attacker to degrade service availability by submitting specially-crafted Markdown. The vulnerability is fixed in version 14.2.0. Although the typographer feature is off by default, many production applications enable it for enhanced typography, making this issue relevant to deployed systems.

• CVE-2026-48990MEDIUM 5.3

  joserfc, a Python library for handling JSON Web Signatures and Encryption, has a flaw in how it processes unencoded JWS payloads (a feature defined in RFC7797). The library correctly enforces maximum payload size limits for standard JWS formats, but bypasses those same limits when processing JWS tokens marked with b64=false, which signals unencoded payloads. An attacker can exploit this inconsistency by sending an oversized JWS token that passes validation despite exceeding configured size restrictions, potentially exhausting server memory and causing denial of service. The vulnerability affects versions 1.3.4 through 1.6.5 and is resolved in version 1.6.7.

• CVE-2026-54712MEDIUM 5.3

  OpenTelemetry Java Instrumentation versions before 2.27.0 contain a denial-of-service vulnerability in the RMI context propagation handler. An attacker with network access to an exposed RMI endpoint can send specially crafted payloads that bypass size limits on individual context strings, forcing the instrumented JVM to allocate excessive memory. This can degrade or crash the application. The vulnerability only affects deployments where RMI instrumentation is explicitly enabled and the RMI endpoint is network-accessible.

• CVE-2026-55594MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing toolkit, contains a stack overflow vulnerability in its MVG (Magick Vector Graphics) decoder. When processing a specially crafted image file, the decoder fails to validate recursion depth, allowing the stack to overflow and crash the application. An attacker can exploit this by sending a malicious image to any system running a vulnerable version of ImageMagick, causing a denial of service. The vulnerability affects versions prior to 6.9.13-51 (stable branch) and 7.1.2-26 (development branch).

• CVE-2026-57962MEDIUM 5.3

  Thunderbird users who have configured LDAP (Lightweight Directory Access Protocol) servers for address-book autocomplete are vulnerable to a denial-of-service attack. A malicious LDAP server can respond with extremely large amounts of data that Thunderbird attempts to store, eventually consuming all available memory and crashing the application. An attacker would need to either control an LDAP server that a victim queries, or intercept traffic to a legitimate LDAP server. This is not a data breach or code execution risk, but it can disrupt email service availability.

• CVE-2026-58203MEDIUM 5.3

  pydantic-settings is a Python library that manages application configuration through Pydantic models. Versions 2.12.0 through 2.14.1 contain a flaw in how they handle secret files stored in a designated secrets directory. When the nested subdirectory feature is enabled, the library will follow symbolic links (shortcuts) that point outside the intended secrets directory, allowing it to read arbitrary files from the system. An attacker with write access to the secrets directory—such as in a shared or world-writable mount—can create malicious symbolic links to trick the application into loading sensitive files from anywhere on the system. This also bypasses the documented size limit protection meant to prevent loading oversized files.

• CVE-2026-8609MEDIUM 5.3

  Grafana has a denial-of-service vulnerability in its OAuth login flow. An unauthenticated attacker can send repeated login attempts with varying parameters, causing the application to leak memory without bound. Eventually, the Grafana instance runs out of memory and crashes, disrupting availability for legitimate users. No authentication is required to trigger this issue, making it accessible to anyone on the network.

• CVE-2026-54786MEDIUM 5.0

  Wasmtime, a WebAssembly runtime, contains a resource leak in its implementation of the WASIp1 file descriptor renumbering function (fd_renumber). When a WebAssembly guest program renumbers a file descriptor, Wasmtime updates its internal descriptor table but fails to clean up the corresponding entry in the host operating system's file descriptor table. This leaves orphaned file descriptors and other resources that accumulate in the host until the entire Wasmtime Store is destroyed. An attacker with the ability to execute WebAssembly code and access file descriptors can deliberately call fd_renumber in a loop to exhaust the host's file descriptor pool and memory, causing a denial of service. The vulnerability requires authenticated access (file descriptor capability) and affects only runtimes that expose both fd_renumber and file access to guest modules.

• CVE-2026-11790MEDIUM 4.9

  389 Directory Server contains a weakness in how it handles password verification when using PBKDF2-SHA256 encryption. An attacker with administrative access can tamper with a user's stored password hash to include an extremely high iteration count. When that user (or an automated system) attempts to authenticate, the server wastes excessive CPU resources recalculating the password hash, effectively freezing responsiveness for legitimate users. This is a denial-of-service attack that requires the attacker to already have administrative privileges to modify password data.

• CVE-2026-55595MEDIUM 4.7

  ImageMagick, a widely used image processing tool, contains a flaw that causes it to enter an infinite loop when given malformed input to its connected-components feature. An attacker could exploit this by crafting a specially formed image file or command that triggers the loop, effectively freezing the application and making it unavailable until forcibly stopped. The issue affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-49324MEDIUM 4.6

  A vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech allows someone with access to the bike's internal network to permanently disable it. By sending a small number of specially crafted wireless messages, an attacker can trigger a lockout on the motorcycle's immobilizer system—the security mechanism that prevents unauthorized starting. Unlike typical lockouts that reset when you power cycle the device, this one persists even after restarting the bike, leaving owners unable to start their motorcycle until they visit a dealer for service.

• CVE-2026-10156MEDIUM 4.3

  Open5GS, a popular open-source 5G core network implementation, contains a denial-of-service vulnerability in versions up to 2.7.7. An authenticated attacker can manipulate how the system manages network function instance information, causing the application to consume excessive resources and become unresponsive. The vulnerability has been publicly disclosed, but a patch is already available. This is a moderate-severity issue requiring prioritization for 5G infrastructure operators and anyone running affected Open5GS deployments.

• CVE-2026-10291MEDIUM 4.3

  Enderfga's claw-orchestrator contains a flaw in how it validates regular expressions in the Session Grep Endpoint. An authenticated attacker can supply a maliciously crafted regex pattern that forces excessive CPU consumption, potentially slowing or freezing the service. This is a medium-severity issue affecting versions up to 3.7.0 and is remedied by upgrading to 3.7.1.

• CVE-2026-10691MEDIUM 4.3

  A vulnerability in wonderwhy-er DesktopCommanderMCP through version 0.2.38 allows an authenticated user to trigger a denial-of-service condition by crafting malicious search result data that causes inefficient regular expression processing. The flaw is in the search-manager component and can be exploited remotely by any logged-in user. The vendor has released version 0.2.39 with a fix.

• CVE-2026-10692MEDIUM 4.3

  A flaw exists in code-index-mcp versions up to 2.14.0 that allows authenticated users to cause performance degradation through specially crafted regular expressions. By submitting a malicious regex pattern to the search_code_advanced function, an attacker can trigger inefficient regex processing that consumes excessive CPU resources, leading to application slowdown or unresponsiveness. This is a denial-of-service weakness that requires login credentials to exploit but does not compromise confidentiality or data integrity.

• CVE-2026-10802MEDIUM 4.3

  A resource consumption vulnerability exists in KeystoneJS, an open-source headless CMS and GraphQL API framework. The flaw resides in the GraphQL API endpoint handler and can be exploited by authenticated users to exhaust server resources, potentially causing a denial-of-service condition. The vulnerability affects KeystoneJS versions up to March 19, 2026. Exploitation requires valid credentials but can be performed remotely over the network.

• CVE-2026-42005MEDIUM 4.3

  CVE-2026-42005 is a denial-of-service vulnerability affecting an internal web server component. An attacker with valid credentials can send a specially crafted web request that triggers unbounded memory allocation, exhausting system memory and causing service interruption. The risk is naturally contained by the fact that this internal web server is disabled by default in most deployments, meaning organizations must have explicitly enabled it to be vulnerable.

• CVE-2026-54260MEDIUM 4.3

  Wagtail, a Django-based content management system, contains a vulnerability in versions before 7.0.8, 7.3.3, and 7.4.2 that allows authenticated admin users to degrade system performance by uploading or processing images with specially crafted filter specifications. The vulnerability requires admin-level access to the Wagtail backend, so it cannot be exploited by regular website visitors. When triggered, the malicious filter specs force the system to perform expensive image rendition processing operations that consume significant server resources, potentially slowing or disrupting the CMS for all users.

• CVE-2026-54886MEDIUM 4.3

  An authenticated user on an SFTP server powered by Erlang/OTP can send specially crafted network messages that cause the SFTP channel handler to enter an infinite loop. The vulnerable code path is triggered only when the server receives SSH extended data (a message type that should never appear in normal SFTP operations) with specific properties. Once triggered, that channel stops responding and consumes CPU continuously, though the overall server remains operational. An attacker with valid SFTP credentials can open many such channels to degrade performance across the system. No data theft or modification is possible; the impact is purely denial of service.

• CVE-2026-11478LOW 3.3

  CVE-2026-11478 is a denial-of-service vulnerability in the kokke tiny-regex-c library that allows a local attacker to trigger inefficient regular expression processing through the matchstar function. An attacker with local access and basic privileges can craft a malicious regex pattern that causes excessive computation, potentially slowing or stalling applications that parse untrusted regex inputs. The severity is low because exploitation requires local execution and user-level permissions, but the published exploit code means the attack method is already in the wild.

• CVE-2026-14683LOW 3.3

  HdrHistogram, a popular latency histogram library, contains a vulnerability in how it processes compressed binary data. An attacker with local access could supply specially crafted compressed data that causes the application to allocate excessive memory, potentially leading to a denial of service. The vulnerability exists in versions up to 2.2.2 and requires local system access to exploit. The security community remains divided on whether this truly constitutes a security boundary crossing, given the prerequisites involved.

• CVE-2026-14684LOW 3.3

  HdrHistogram, a Java library used for recording and analyzing latency distributions, contains a flaw in how it decodes serialized histogram data from byte buffers. When processing the numberOfSignificantValueDigits parameter during deserialization, the library can allocate excessive memory without proper bounds checking. This is a local-only vulnerability—an attacker must already have access to run code on the affected system. While proof-of-concept code has been published, the security community disputes whether this crosses a meaningful security boundary, since the preconditions for exploitation are restrictive.

• CVE-2026-10705LOW 3.1

  Dask, a Python library for parallel computing and distributed data processing, contains a resource exhaustion vulnerability in its HyperLogLog (approximate distinct count) functionality. An authenticated remote attacker can trigger excessive resource consumption through the nunique_approx function, potentially degrading system availability. The flaw requires significant attack complexity and specific preconditions, making real-world exploitation difficult despite being theoretically possible.