Export limit exceeded: 24421 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 402653 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51608 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51608 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-2050 | 1 Gimp | 1 Gimp | 2026-09-09 | 7.8 High |
| GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28266. | ||||
| CVE-2026-81396 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81390 | 1 Microsoft | 12 365 Apps, Excel, Excel 2016 and 9 more | 2026-09-09 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81389 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-78515 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-09 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-81952 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-09 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78526 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-09 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78521 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-09 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-77906 | 1 Microsoft | 1 Visual Studio 2026 | 2026-09-09 | 8.8 High |
| Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-72972 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-09 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-11733 | 1 Netgear | 22 Rax41, Rax41 Firmware, Rax41v2 and 19 more | 2026-09-09 | 4.9 Medium |
| A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device. | ||||
| CVE-2026-11734 | 1 Netgear | 30 Mr70, Mr70 Firmware, Mr90 and 27 more | 2026-09-09 | 2.7 Low |
| A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable. | ||||
| CVE-2026-11735 | 1 Netgear | 40 R7000, R7000 Firmware, Rax20 and 37 more | 2026-09-09 | 4.9 Medium |
| A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality. | ||||
| CVE-2026-20502 | 2 Mediatek, Mediatek, Inc. | 107 Mt2718, Mt2718 Firmware, Mt6580 and 104 more | 2026-09-09 | 8.4 High |
| In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9196. | ||||
| CVE-2026-20501 | 2 Mediatek, Mediatek, Inc. | 107 Mt2718, Mt2718 Firmware, Mt6580 and 104 more | 2026-09-09 | 8.4 High |
| In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9197. | ||||
| CVE-2026-18743 | 2 Redhat, Rpm-software-management | 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more | 2026-09-08 | 2.5 Low |
| A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service). | ||||
| CVE-2026-67624 | 1 Microsoft | 6 Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr), Microsoft Sql Server 2025 For X64-based Systems (gdr) and 3 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-53704 | 2 Gstreamer Project, Redhat | 4 Gstreamer Plugin, Enterprise Linux, Enterprise Linux Eus and 1 more | 2026-09-08 | 7.1 High |
| A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents. | ||||
| CVE-2026-18355 | 1 Redhat | 10 Directory Server, Directory Server E4s, Enterprise Linux and 7 more | 2026-09-08 | 7.5 High |
| A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow. | ||||
| CVE-2026-57432 | 2 Perl, Shay | 2 Perl, Perl | 2026-09-08 | 8.4 High |
| Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller. | ||||