CWE-407

CVEs per yearBy the year they were published

1. 20172
2. 20181
3. 20191
4. 20213
5. 20224
6. 202310
7. 202413
8. 202519
9. 2026230

Newest CVEs

• CVE-2026-123608

  Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression

  hickory-dns · hickory-dns

  High8.7
• CVE-2026-123559

  Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

  ZcashFoundation · zebra

  High8.7
• CVE-2026-123554

  Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

  ZcashFoundation · zebra

  High8.7
• CVE-2026-123792

  Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

  sensiolabs · symfony

  High8.7
• CVE-2026-122306

  Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching

  kyverno · kyverno

  High8.3
• CVE-2026-106554

  jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

  FasterXML · jackson-dataformat-cbor

  Not scored
• CVE-2026-119741

  rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions

  RsyncProject · rsync

  High8.7
• CVE-2026-121437

  Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

  lepture · mistune

  High8.7
• CVE-2026-62160

  Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

  daptin · daptin

  High8.7
• CVE-2026-87768

  DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds

  DateTime-Lite

  High7.5

Vendors it comes up for most

1. py-pdf10
2. Apache Software Foundation8
3. OISF8
4. Progressive Robot Ltd8
5. thephpleague8
6. GitLab7
7. Microsoft7
8. lepture7
9. Red Hat6
10. djangoproject6