CWE-400
CVEs classified under CWE-400, newest first.
1100 CVEsRSS
CVE-2026-101731Medium· 4.9mysql: MySQL Server: Denial of service in the Server Optimizer (CVE-2026-101731)
A flaw was found in the MySQL Server Optimizer. A remote attacker with high privileges can exploit this vulnerability over network protocols to cause the server to hang or crash repeatedly. This issue results in a complete denial of servic…
CVE-2026-101748Medium· 6.5mysql: mysql: Denial of Service via the audit component (CVE-2026-101748)
A flaw was found in the audit component of MySQL. An authenticated remote attacker with low privileges can exploit this vulnerability over the network across multiple protocols. Successful exploitation allows the attacker to cause a hang o…
CVE-2026-101747Medium· 6.5mysql: mysql: Denial of Service in InnoDB (CVE-2026-101747)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101751Medium· 4.9mysql: mysql: Denial of Service in Group Replication (CVE-2026-101751)
A flaw was found in MySQL. An authenticated, remote attacker with high privileges could cause a complete Denial of Service (DoS) by exploiting a vulnerability in the Group Replication component over the network. Successful exploitation cau…
CVE-2026-101754Medium· 4.4mysql: mysql: Denial of Service via client programs (CVE-2026-101754)
A flaw was found in MySQL client programs. A remote attacker with high privileges and network access can exploit this vulnerability to compromise the system. Successful exploitation allows the attacker to cause the database server to hang …
CVE-2026-101760Medium· 4.9mysql: mysql: Denial of service in InnoDB (CVE-2026-101760)
A flaw was found in the InnoDB component of MySQL. A remote attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or crash repeatedly, resulting in a denial of service (DoS).
CVE-2026-101766Medium· 4.4mysql: mysql: Denial of service in replication component (CVE-2026-101766)
A flaw was found in the MySQL replication component. A remote, highly privileged attacker could exploit this vulnerability over the network to cause MySQL Server or MySQL Cluster to hang or crash repeatedly. This issue leads to a complete …
CVE-2026-101778Medium· 6.5mysql: mysql: Denial of Service (CVE-2026-101778)
A flaw was found in the Components Services component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU …
CVE-2026-101773High· 7.1mysql: MySQL: Denial of Service via the Group Replication plugin (CVE-2026-101773)
A flaw was found in the MySQL Group Replication plugin. An unauthenticated attacker located on the adjacent network can exploit this vulnerability to compromise the database service. Successful exploitation primarily allows an attacker to …
CVE-2026-101779Low· 2.7mysql: mysql: Partial Denial of Service via Telemetry component (CVE-2026-101779)
A flaw was found in the MySQL Server Telemetry component. A remote attacker with high privileges and network access can exploit this vulnerability over multiple protocols to cause a partial Denial of Service (DoS). Successful exploitation …
CVE-2026-101775High· 7.4mysql: mysql: unauthorized data modification via replication component (CVE-2026-101775)
A flaw was found in the MySQL Server replication component. An unauthenticated remote attacker with network access could exploit this vulnerability to create, delete, or modify critical database data. A successful attack can also lead to a…
CVE-2026-101784Medium· 4.9mysql: mysql: Denial of service in query optimizer (CVE-2026-101784)
A flaw was found in the query optimizer component of MySQL Server and MySQL Cluster. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause a Denial of Service (DoS). Successful exploitati…
CVE-2026-101789Medium· 6.5mysql: mysql: Denial of Service via the Optimizer component (CVE-2026-101789)
A flaw was found in the MySQL Optimizer component. An authenticated remote attacker with low privileges can exploit this vulnerability over the network to cause a Denial of Service (DoS). Successful exploitation allows the attacker to hang…
CVE-2026-101799Medium· 6.5mysql: mysql: Denial of Service via Group Replication GCS (CVE-2026-101799)
A flaw was found in the Group Replication GCS component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CP…
CVE-2026-101795Medium· 6.7mysql: mysql: Complete service compromise by a local privileged attacker (CVE-2026-101795)
A flaw was found in the Components Services component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU …
CVE-2026-101796High· 7.5mysql: mysql: Complete server takeover via replication component (CVE-2026-101796)
A flaw was found in the Replication component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory…
CVE-2026-101802Medium· 6.5mysql: mysql: Denial of Service via the Server Parser (CVE-2026-101802)
A flaw was found in the MySQL Server Parser component. An authenticated remote attacker with low privileges can exploit this vulnerability through network access using multiple protocols. A successful attack can cause the service to hang o…
CVE-2026-93441High· 8.6IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-111758High· 7.5PoCmarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily wi…
CVE-2026-111751High@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
CVE-2026-113666High· 7.1PoCApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113658High· 7.5PoCApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not…
CVE-2026-95108Medium· 6.8Deleting a user-mode module thread leaks its privileged kernel stack
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_cr…
CVE-2026-112955Medium· 6.5ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…
CVE-2026-111752High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
CVE-2026-113619High· 7.5Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject …
CVE-2026-108062Medium· 6.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
CVE-2026-112400High· 7.5PoCPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
CVE-2026-112300Medium· 5.3DiffSK configobj __init__.py _sectionmarker redos
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote …