CVE-2026-100138 is an uncontrolled resource consumption vulnerability in the Adobe Content Credentials Rust SDK that can lead to application denial-of-service. An attacker can exploit this issue remotely without user interaction to exhaust system resources, causing the application to become unavailable. The vulnerability has a high severity rating with a CVSS score of 7.5. No patch or remediation information is currently provided by the vendor.
CVE-2026-67626 is a vulnerability in Microsoft SQL Server 2022 (GDR) involving uncontrolled resource consumption. This flaw allows an authorized attacker to cause a denial of service (DoS) over the network by exhausting system resources. The issue affects multiple versions of SQL Server 2022 and has been assigned a medium severity rating with a CVSS score of 6.5. Official patches have been released to address this vulnerability.
Adobe ColdFusion 2025 contains an Uncontrolled Resource Consumption vulnerability (CWE-400) that can lead to application denial-of-service. This vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. The issue affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-95696 is a medium severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves uncontrolled resource consumption caused by an uncaught exception, which could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
CVE-2026-97811 is a high-severity double free vulnerability in OpenSSH for Microsoft Windows 10 Version 1809. It allows an authorized local attacker to elevate privileges by exploiting improper memory management. The issue affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-97775 is a use-after-free vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has issued official fixes in multiple versions to address this issue.
CVE-2026-33374 is a vulnerability in Grafana Enterprise affecting the Prometheus rule conversion API endpoints. These endpoints do not limit the size of the request body, allowing authenticated users to cause unbounded memory allocations. This can lead to out-of-memory conditions that crash the server. The vulnerability affects multiple versions of Grafana Enterprise from 12.0.0 through versions prior to 12.3.12, 12.4.0 through prior to 12.4.13, 13.0.0 through prior to 13.0.11, 13.1.0 through prior to 13.1.8, and 13.2.0 through prior to 13.2.4. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-90911 is a high-severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves uncontrolled resource consumption that could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability that allows a remote attacker to cause a denial of service via an infinite parsing loop when processing certain inputs. This vulnerability is classified as CWE-400, indicating uncontrolled resource consumption. The issue can be exploited without authentication and requires no user interaction.
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
CVE-2026-107840 is an uncontrolled resource consumption vulnerability in the Prometheus metrics middleware of jhaals yopass before version 14.7.0. The middleware uses the HTTP request method directly as a label value in metrics, allowing an attacker to send requests with arbitrary method strings. This causes unbounded growth in Prometheus metric time series, leading to memory exhaustion and degraded metrics scrape performance.
CVE-2026-107839 is a high-severity vulnerability in luskaner's ageLANServer prior to version 1.15.2. The vulnerability arises from the POST /game/cloud/getFileURL handler, which lacks limits on the size of the request body and the length of an attacker-controlled JSON array. This can lead to uncontrolled memory allocation, causing the server to crash or hang, disrupting active players and making the service unavailable until restarted. The issue is resolved in version 1.15.2.
CVE-2026-107834 is a medium severity vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x. It involves uncontrolled resource consumption due to the handling of multipart file uploads, where temporary file descriptors remain open until the entire request completes. An unauthenticated attacker can exploit this by submitting many minimal file parts, exhausting the process file descriptor table and causing failures in creating temporary files, blocking legitimate uploads and preventing the process from opening files or sockets. This issue is fixed in version 3.8.0.
CVE-2026-107805 is a high-severity vulnerability in 0xJacky's nginx-ui versions from 2.5.0 up to but not including 2.6.0. It involves uncontrolled resource consumption due to temporary file staging of attacker-controlled request bodies before signature validation. This can lead to denial of service by exhausting filesystem and processing resources. The issue affects availability only and does not impact authentication, confidentiality, or integrity. The vulnerability is fixed in version 2.6.0.
A resource consumption vulnerability exists in the legacy graphql-ws subscription handler of strawberry-graphql versions from 0.312.3 up to but not including 0.327.2. Completed subscription operations are not removed from internal tracking structures, allowing a client to exhaust the configured subscription slots on a persistent WebSocket connection. This causes legitimate new subscriptions to be rejected due to reaching the subscription limit. The issue does not affect the modern graphql-transport-ws protocol or deployments without per-connection subscription caps. The vulnerability is fixed in version 0.327.2.
A vulnerability in Borewit music-metadata versions before 11.15.0 causes an unhandled exception leading to a process crash. The issue arises from an un-awaited asynchronous call when skipping unrecognized chunks in DSF audio files, which can result in a negative argument passed to a function that throws a RangeError. This error occurs after the main parsing promise resolves, making it uncatchable by typical try/catch error handling. The impact is a denial-of-service (DoS) condition where a single crafted DSF file can crash the Node.js process using music-metadata, affecting availability.
A resource consumption vulnerability exists in Borewit's music-metadata library prior to version 11.16.0. The flaw occurs in the MP4 stsd sample-description parser where an attacker can craft an MP4 input with a zero sample-entry size and a controlled entry_count, causing an infinite synchronous loop. This leads to blocking the Node.js event loop and potentially exhausting system memory. The issue was introduced after version 11.14.0 and fixed in version 11.16.0.
IBM Guardium Data Protection version 12.2.2 contains a denial-of-service vulnerability in its edge-controller component. An unauthenticated remote attacker with network access to the edge-controller's gRPC service can send malformed task data that triggers an unchecked type assertion, causing the edge-controller process to crash unexpectedly. This results in service disruption without impacting confidentiality or integrity.