Base de CVEs

CVE-2025-14513 Alta · 7.5 CWE-1284 11/03/2026

Improper Validation of Specified Quantity in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

CVE-2026-3816 Média · 6.5 CWE-1284 09/03/2026

OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

CVE-2026-27384 Crítica · 9.0 CWE-1284 05/03/2026

WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability

Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.

CVE-2026-3381 Crítica · 9.8 CWE-1284 04/03/2026

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

CVE-2026-26934 Média · 6.5 CWE-1284 26/02/2026

Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service

Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.

CVE-2025-14511 Alta · 7.5 CWE-1284 25/02/2026

Improper Validation of Specified Quantity in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

CVE-2026-27171 Média · 5.5 CWE-1284 18/02/2026

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64…

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

CVE-2025-14689 Média · 6.5 CWE-1284 17/02/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.

CVE-2025-13867 Média · 6.5 CWE-1284 17/02/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

CVE-2025-52534 Média · 5.3 CWE-1284 10/02/2026

Improper bound check within AMD CPU microcode can allow a malicious guest to write to…

Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity.

CVE-2024-21953 Média · 5.9 CWE-1284 10/02/2026

Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure…

Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.

CVE-2025-15080 Alta · 8.8 CWE-1284 05/02/2026

Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.

CVE-2025-36094 Alta · 8.1 CWE-1284 03/02/2026

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 could allow an authenticated user to cause a denial of service or corrupt existing data due to the improper validation of input length.

CVE-2025-36428 Média · 5.3 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled.

CVE-2025-36427 Média · 6.5 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic.

CVE-2025-36424 Média · 6.5 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.

CVE-2025-36423 Média · 5.5 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

CVE-2025-36407 Média · 5.5 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

CVE-2025-36009 Média · 6.5 CWE-1284 30/01/2026

IBM Db2 Denial of Service

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

CVE-2026-0925 Média · 4.9 CWE-1284 26/01/2026

Tanium addressed an improper input validation vulnerability in Discover.

CVE-2025-11743 Alta · 7.1 CWE-1284 20/01/2026

Rockwell Automation CompactLogix® 5370 Denial of Service Vulnerability

A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a major nonrecoverable fault a restart is required to recover.

CVE-2021-47831 Alta · 7.5 CWE-1284 16/01/2026

Sandboxie 5.49.7 - Denial of Service

Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the container folder input field. Attackers can paste a large buffer of repeated characters into the Sandbox container folder setting to trigger an application crash.

CVE-2021-47827 Alta · 7.5 CWE-1284 16/01/2026

WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field, causing the application to crash.

CVE-2021-47824 Alta · 7.5 CWE-1284 16/01/2026

iDailyDiary 4.30 - Denial of Service (PoC)

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash.

CVE-2021-47821 Alta · 7.5 CWE-1284 16/01/2026

RarmaRadio 2.72.8 - Denial of Service

RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuration fields with large character buffers. Attackers can generate a 100,000 character buffer and paste it into multiple network settings fields to trigger application instability and potential crash.