Export limit exceeded: 54326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (54326 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-14181 | 3 Php, Php Group, Redhat | 3 Php, Php, Hummingbird | 2026-10-23 | 6.5 Medium |
| The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow. | ||||
| CVE-2025-1218 | 3 Microsoft, Php, Php Group | 3 Windows, Php, Php | 2026-10-23 | 3.4 Low |
| The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process. | ||||
| CVE-2026-57488 | 2 Pupnp, Pupnp Project | 2 Pupnp, Pupnp | 2026-10-23 | 7.1 High |
| pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2. | ||||
| CVE-2026-6103 | 3 Php, Php Group, Redhat | 3 Php, Php, Hummingbird | 2026-10-23 | 4.3 Medium |
| phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine. | ||||
| CVE-2026-31694 | 2 Linux, Siemens | 3 Linux Kernel, Simatic S7-1500 Tm Mfp, Simatic S7-1500 Tm Mfp Firmware | 2026-10-23 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache. | ||||
| CVE-2026-111678 | 2 Adri Van Os, Antiword Project | 2 Antiword, Antiword | 2026-10-23 | 3.3 Low |
| Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing. | ||||
| CVE-2026-108427 | 1 Microsoft | 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more | 2026-10-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108439 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-111165 | 2 Raphael Assenat, Sezero | 2 Libmikmod, Libmikmod | 2026-10-23 | 5.5 Medium |
| libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application. | ||||
| CVE-2026-111166 | 2 Raphael Assenat, Sezero | 2 Libmikmod, Libmikmod | 2026-10-23 | 5.5 Medium |
| libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file. | ||||
| CVE-2026-108447 | 1 Microsoft | 6 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office Ltsc 2021 and 3 more | 2026-10-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-100350 | 1 Getkin | 1 Kin-openapi | 2026-10-23 | 5.3 Medium |
| kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0. | ||||
| CVE-2026-77466 | 1 Lycheeorg | 1 Lychee | 2026-10-23 | N/A |
| Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0. | ||||
| CVE-2026-111105 | 1 Telegram | 1 Telegram | 2026-10-23 | N/A |
| Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207. | ||||
| CVE-2026-92559 | 1 Ibm | 1 App Connect Enterprise | 2026-10-23 | 9.8 Critical |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. | ||||
| CVE-2026-92208 | 1 Nomachine | 1 Nomachine | 2026-10-23 | N/A |
| NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982. | ||||
| CVE-2026-92183 | 1 Gimp | 1 Gimp | 2026-10-23 | 7.8 High |
| GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400. | ||||
| CVE-2026-76587 | 1 Ibm | 1 Planning Analytics | 2026-10-23 | 8.8 High |
| IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | ||||
| CVE-2026-111814 | 2 Apache, Apache Software Foundation | 3 Apache Traffic Server, Traffic Server, Apache Traffic Server | 2026-10-23 | 10 Critical |
| Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||||
| CVE-2026-111183 | 1 Gstreamer | 1 Gstreamer | 2026-10-23 | N/A |
| GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143. | ||||