CWE-404
CVEs classified under CWE-404, newest first.
148 CVEsRSS
CVE-2026-117506Medium· 4.3a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sd…
CVE-2026-117505Medium· 4.3a2aproject a2a-java ChildQueue queue.offer resource consumption
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be init…
CVE-2026-117504Medium· 5.3a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of …
CVE-2026-117503Medium· 5.3a2aproject a2a-go REST SSE handler rest.go resource consumption
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the …
CVE-2026-115971Medium· 5.3PoCTravisun Opptrix preParsing handler webhook Buffer.concat denial of service
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be…
CVE-2026-113872High· 7.5PoCmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-112157Low· 3.1PoCMemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption
A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resou…
CVE-2026-112083Medium· 5.3PoCsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of th…
CVE-2026-112082High· 7.5PoCsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording En…
CVE-2026-110809Medium· 4.3PoCA security vulnerability has been detected in sgl-project SGLang up to 0.5.19
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such m…
CVE-2026-110807Medium· 4.3PoCA weakness has been identified in sgl-project SGLang up to 0.5.19
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of th…
CVE-2026-49785High· 7.8Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVE-2026-109144Medium· 5.3A vulnerability was identified in wbond certvalidator up to 0.11.1
A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotel…
CVE-2026-109107Medium· 6.5PoCA weakness has been identified in Wavlink WL-WN592AX6 250422
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible t…
CVE-2026-109277Low· 3.3ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling
ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current op…
CVE-2026-108769Medium· 4.3PoCA security flaw has been discovered in zhayujie CowAgent up to 2.2.0
A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the …
CVE-2026-108682Medium· 5.4PoCA weakness has been identified in zhayujie CowAgent up to 2.1.6
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attac…
CVE-2026-108681Medium· 4.3PoCA security flaw has been discovered in zhayujie CowAgent up to 2.1.7
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of s…
CVE-2026-108577Medium· 4.3A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource cons…
CVE-2026-105922Medium· 4.3PoC⚖ disputedA security flaw has been discovered in vllm-project vLLM up to 0.31.0
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation re…
CVE-2026-105250Medium· 4.3A security vulnerability has been detected in vgmstream up to r2117
A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attac…
CVE-2026-90440High· 8.2Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are r…
Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are r…
CVE-2026-103241Medium· 5.3PoC⚖ disputedA flaw has been found in vllm-project vLLM up to 0.26.0
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of servi…
CVE-2026-47491High· 7.8NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A succes…
CVE-2026-103118Medium· 4.3A vulnerability was detected in GraphicsMagick up to 1.3.47
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled r…
CVE-2026-101098Medium· 4.3A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resou…
CVE-2026-101040Medium· 6.5PoCA security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of s…
CVE-2026-100902Medium· 6.5PoCA vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007
A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper…
CVE-2026-100895Medium· 5.3PoCA security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null point…
CVE-2026-100890Medium· 5.3PoCA flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation o…