CVE-2025-54149 is an uncontrolled resource consumption vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack, potentially disrupting service availability. The vulnerability does not require user interaction or network-level authentication but does require local user privileges. It has a CVSS 4.9 (medium) score, reflecting moderate impact and ease of exploitation. The issue has been fixed in Qsync Central version 5.
CVE-2025-54150 is an uncontrolled resource consumption vulnerability affecting QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack by exhausting system resources. The vulnerability does not require user interaction or elevated privileges beyond a user account. It has a CVSS v4.0 base score of 4.9, indicating medium severity.
CVE-2025-54151 is an uncontrolled resource consumption vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack by exhausting system resources. The vulnerability does not require user interaction or elevated privileges beyond a user account. It has a CVSS 4.9 (medium) severity score and was fixed in Qsync Central version 5.0.
CVE-2025-54155 is a resource allocation vulnerability in QNAP Systems Inc. 's File Station 5, affecting versions 5.5.x prior to 5.5.6.5018. A remote attacker with administrator privileges can exploit this flaw to exhaust resources without limits or throttling, potentially denying access to those resources for other systems, applications, or processes. The vulnerability requires high privileges and does not need user interaction. Although the CVSS score is low (3.
CVE-2025-54161 is a resource allocation vulnerability in QNAP File Station 5 versions 5.5.x that allows a remote attacker with administrator privileges to exhaust system resources without limits or throttling. This can lead to denial of service conditions affecting other systems, applications, or processes relying on the same resources. The vulnerability does not require user interaction but does require high privileges (administrator access). It has a low CVSS score of 3.6, reflecting limited impact and exploitation complexity. The issue has been fixed in File Station 5 version 5.5.6.
CVE-2025-57708 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to exhaust shared resources without limits or throttling, potentially causing denial of service for other systems or processes. The vulnerability is classified under CWE-770, indicating improper management of resource allocation. It has a low CVSS 4.0 score of 2.3 due to the requirement of authenticated access and limited impact on confidentiality and integrity.
CVE-2025-57710 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with administrator privileges can exploit this flaw to exhaust specific system resources without limits or throttling, causing denial of service to other systems, applications, or processes relying on the same resources. The vulnerability does not require user interaction but does require high privileges (administrator access). It has a CVSS 4.0 base score of 3.6, indicating low severity.
CVE-2025-57711 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x that allows a remote attacker with administrator privileges to exhaust resources without limits or throttling, potentially denying access to those resources for other systems or processes. The vulnerability is classified under CWE-770 and has a CVSS 4.0 base score of 3.6, indicating low severity. Exploitation requires high privileges (administrator access) and does not require user interaction. The issue was fixed in Qsync Central version 5.
CVE-2025-58471 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.2.x.x. A remote attacker with administrator privileges can exploit this flaw to exhaust resources without limits or throttling, potentially denying access to those resources for other systems, applications, or processes. The vulnerability does not require user interaction and has a low CVSS score of 1.2, indicating limited impact and ease of exploitation. It has been fixed in Qsync Central version 5.2.
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.
Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.
CVE-2025-32393 is a high-severity denial-of-service (DoS) vulnerability in Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.32. The flaw exists in the ReadRSSFeedBlock component, where the feedparser.parser processes user-supplied XML feeds without limits on parsing time or resource allocation. An attacker can craft deeply nested or complex XML payloads that exhaust memory resources, causing the application to crash or become unresponsive. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the CVSS 8.7 score reflects the ease of exploitation and high impact on availability. The issue has been patched in version 0.
CVE-2025-1823 is a low-severity vulnerability in IBM Jazz Reporting Service versions 7.1 and 7.0.3 that allows an authenticated user on the host network to cause a denial of service by submitting specially crafted SQL queries that consume excessive memory resources. The flaw stems from the allocation of resources without proper limits or throttling (CWE-770). Exploitation requires low privileges and no user interaction but is limited to authenticated users within the host network. While no known exploits are currently in the wild, successful attacks could disrupt reporting services by exhausting memory, impacting availability. The vulnerability does not affect confidentiality or integrity and has a CVSS score of 3.5. European organizations using affected IBM Jazz Reporting Service versions should monitor for patches and restrict access to trusted users to mitigate risk.
IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service.
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
CVE-2026-22780 is a medium severity heap overflow vulnerability in rizin versions prior to 0.8.2. It occurs when rizin parses a malicious Mach-O file containing bogus entries in the dyld chained segments, leading to allocation of resources without proper limits or throttling. Exploitation requires local access and user interaction, with no privileges needed, and can result in partial integrity and availability impacts. The vulnerability has not been observed exploited in the wild and was fixed in version 0.8.2. European organizations using rizin for reverse engineering or malware analysis should update promptly to mitigate risks. The threat primarily affects UNIX-like environments where rizin is deployed, with higher relevance in countries with strong cybersecurity research and software development sectors.