CWE-834

CWE-834 · 11 records · 8 with a public proof-of-concept

Records the NVD classes under CWE-834, highest CVSS first.

  1. MEDIUM 6.5CVE-2026-115911public PoC2026-10-26

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that…

    vllm

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 6.5CVE-2026-77399public PoC2026-09-22

    icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an applica…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 5.5CVE-2026-125183public PoC2026-11-09

    FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units t…

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 5.5CVE-2026-110596public PoC2026-10-14

    quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective tr…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 5.5CVE-2026-81880public PoC2026-09-22

    radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of section…

    radare2

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.3CVE-2026-106576public PoC2026-10-07

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of servi…

    AI risk analysis on Exploit-DB.ai →

  7. UNSCOREDCVE-2026-115580public PoC2026-10-23

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the fi…

    AI risk analysis on Exploit-DB.ai →

  8. UNSCOREDCVE-2026-907982026-10-20

    A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to ver…

    AI risk analysis on Exploit-DB.ai →

  9. UNSCOREDCVE-2026-911372026-10-02

    Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade t…

    AI risk analysis on Exploit-DB.ai →

  10. UNSCOREDCVE-2026-53493public PoC2026-09-25

    containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at l…

    AI risk analysis on Exploit-DB.ai →

  11. UNSCOREDCVE-2026-877212026-09-24

    Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (o…

    AI risk analysis on Exploit-DB.ai →