Export limit exceeded: 55221 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (55221 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19673 | 1 Zephyrproject | 1 Zephyr | 2026-10-17 | 7.1 High |
| ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data(). With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential. Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len. | ||||
| CVE-2026-88196 | 1 Microsoft | 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more | 2026-10-17 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-14532 | 1 Ibm | 2 Websphere Application Server Liberty, Websphere Application Server Liberty | 2026-10-17 | 4.3 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception. | ||||
| CVE-2026-95904 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111282 | 1 Driftregion | 1 Iso14229 | 2026-10-17 | 8.2 High |
| Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory. | ||||
| CVE-2026-110857 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-10-17 | 7.5 High |
| GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection. | ||||
| CVE-2026-110655 | 1 Miniupnp Project | 1 Miniupnpc | 2026-10-17 | 3.1 Low |
| miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client. | ||||
| CVE-2026-110660 | 1 Vgmstream | 1 Vgmstream | 2026-10-17 | 3.3 Low |
| vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application. | ||||
| CVE-2026-88101 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 7.8 High |
| Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-77532 | 1 Ubiquiti | 1 Edgemax Edgeswitch | 2026-10-17 | 8.8 High |
| A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device. | ||||
| CVE-2026-85821 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 6.5 Medium |
| Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-101023 | 1 Gitea | 1 Gitea | 2026-10-17 | 9.1 Critical |
| Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime. | ||||
| CVE-2013-10076 | 1 Perl | 1 Extutils::typemaps::stl::vector | 2026-10-17 | 7.5 High |
| ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. | ||||
| CVE-2026-96314 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-103500 | 1 Mozilla | 1 Thunderbird | 2026-10-17 | 6.3 Medium |
| An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. | ||||
| CVE-2026-96306 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-17 | 7.8 High |
| Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103513 | 1 Apache | 1 Datasketches | 2026-10-17 | 9.8 Critical |
| Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue. | ||||
| CVE-2026-96843 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 7.8 High |
| Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103501 | 1 Apache | 1 Datasketches | 2026-10-17 | 9.8 Critical |
| Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue. | ||||
| CVE-2026-103635 | 1 Apache | 1 Datasketches | 2026-10-17 | 9.1 Critical |
| Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue. | ||||