CVE-2026-101971 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved platforms affecting the routing protocol daemon (rpd). It allows an unauthenticated adjacent attacker to cause denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. The vulnerability stems from allocation of resources without limits or throttling. No known exploits are reported in the wild. Multiple versions prior to specific patched releases are affected.
CVE-2026-67414 is a medium severity vulnerability in rabbitmq-server affecting versions prior to 4.0.24, 4.1.15, 4.2.10, and 4.3.4. It allows a low-privilege client to cause uncontrolled resource consumption by sending specially crafted AMQP 1.0 arrays with zero-width shared constructors after SASL authentication. This can lead to large memory allocations, triggering node-wide memory alarms and blocking message publishing.
CVE-2026-101896 is a high-severity vulnerability in the @angular/router URL parser affecting server-side rendering (SSR) in Node.js environments. Prior to fixed versions 20.3.32, 21.2.24, and 22.2.0, the router stores numeric matrix parameter names and numeric outlet names as properties on JavaScript objects. This can cause V8 to allocate large dense arrays, leading to excessive heap consumption. An unauthenticated attacker can exploit this by sending crafted requests with repeated numeric parameters, exhausting the Node.js heap and terminating the SSR worker. Pure client-side Angular applications are not affected. The issue is fixed in the specified versions.
CVE-2026-88084 is a vulnerability in Microsoft SQL Server 2019 (GDR) involving allocation of resources without limits or throttling. This flaw allows an authorized attacker to cause a denial of service (DoS) over the network by exhausting resources. The vulnerability affects specific versions prior to 15.0.2200.2 and 15.0.4500.2. Microsoft has issued official fixes for these versions.
CVE-2026-96959 is a high-severity vulnerability in Microsoft .NET Framework 3.5 and related versions involving allocation of resources without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting system resources. Microsoft has released official fixes for affected versions to address this issue.
CVE-2026-96300 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where the RPC Endpoint Mapper Service allows uncontrolled resource consumption. This flaw enables an unauthorized attacker to cause a denial of service (DoS) over the network by exhausting system resources. The issue affects multiple Windows 10 versions prior to specific fixed builds.
CVE-2026-83645 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving Active Directory Federation Services (AD FS). It stems from allocation of resources without limits or throttling, allowing an unauthorized attacker to cause a denial of service over the network. The vulnerability affects multiple Windows versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-70072 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions where the Netlogon service allocates resources without limits or throttling. This flaw allows an authorized attacker to cause a denial of service over the network by exhausting resources. The issue affects multiple Windows 10 builds and some earlier Windows versions. Microsoft has released official fixes for all affected versions.
CVE-2026-96236 is a high-severity vulnerability in Microsoft ASP.NET Core 10.0 involving allocation of resources without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting resources. The issue affects multiple versions of ASP.NET Core, including 8.0, 9.0, 10.0, 11.0, 17.14, and 18.10 branches prior to their respective fixed releases. Microsoft has issued official fixes for all affected versions.
CVE-2026-70181 is a high-severity vulnerability in Microsoft ASP.NET Core 10.0 involving allocation of resources without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting system resources. The vulnerability affects multiple ASP.NET Core versions prior to their respective fixed releases. Official patches have been released to address this issue.
CVE-2026-70159 is a high-severity vulnerability in Microsoft Visual Studio 2022 and related products caused by allocation of resources without limits or throttling in ASP.NET Core. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network by exhausting resources. The issue affects multiple versions of Visual Studio 2022 and related products prior to fixed releases. An official fix is available from Microsoft.
CVE-2026-85321 is a vulnerability in Microsoft Windows Server 2012 R2's Active Directory Federation Services (AD FS) where allocation of resources occurs without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network. The issue affects multiple Windows Server 2012 R2 and later versions prior to specific fixed releases. A high-severity CVSS 3.1 score of 7.5 has been assigned. Official patches are available from Microsoft to address this vulnerability.
CVE-2026-85319 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions involving allocation of resources without limits or throttling in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to cause a denial of service over a network by exhausting system resources. The issue affects multiple Windows versions and has been assigned a high severity rating with a CVSS score of 7.5. Official patches have been released to address this vulnerability.
CVE-2026-70163 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds involving OpenSSH for Windows. It allows an unauthorized attacker to cause a denial of service by allocating resources without limits or throttling. The issue affects multiple Windows 10 versions prior to specific fixed builds. An official fix is available from Microsoft.
CVE-2026-70133 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and other specified versions where the SMB Server improperly allocates resources without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network by exhausting system resources. The vulnerability affects multiple Windows 10 builds prior to their respective fixed versions.
Misskey versions from 12.0.0 through 13.14.2 and from 2023.9.0-beta.1 up to but not including 2026.7.0 have a vulnerability in the unauthenticated fetch-rss API. This API lacks rate limiting and response size restrictions and performs synchronous XML parsing. An attacker can exploit this to cause unbounded outbound HTTP requests and synchronous parsing, leading to resource exhaustion on the instance, amplification of requests toward third-party servers, or probing of network-reachable services even if federation is disabled. The issue is fixed in version 2026.7.0.
CVE-2026-54086 is a vulnerability in the SLE API for Java (sleapi-j) prior to version 5.1.7. It involves allocation of resources without limits or throttling when processing attacker-controlled input, leading to potential exceptions, resource leakage, and denial of service. The issue is fixed in version 5.1.7.
CVE-2026-33374 is a vulnerability in Grafana Enterprise affecting the Prometheus rule conversion API endpoints. These endpoints do not limit the size of the request body, allowing authenticated users to cause unbounded memory allocations. This can lead to out-of-memory conditions that crash the server. The vulnerability affects multiple versions of Grafana Enterprise from 12.0.0 through versions prior to 12.3.12, 12.4.0 through prior to 12.4.13, 13.0.0 through prior to 13.0.11, 13.1.0 through prior to 13.1.8, and 13.2.0 through prior to 13.2.4. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-95502 is a vulnerability in Grafana Nanogit where a Git server used by Grafana's Git Sync provisioning can cause uncontrolled resource consumption by returning oversized or highly compressed responses. This can exhaust Grafana's memory. Exploitation requires that an administrator has configured Git Sync to use the vulnerable Git server. The vulnerability affects multiple version ranges of Grafana Nanogit and has a medium severity rating with a CVSS score of 5.3.
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.