Export limit exceeded: 26473 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (26473 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68580 | 1 Freerdp | 1 Freerdp | 2026-08-05 | 7.5 High |
| FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms. | ||||
| CVE-2026-66312 | 1 Microsoft | 1 Edge Chromium | 2026-08-05 | 6.5 Medium |
| Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-0931 | 1 M-files | 1 Server | 2026-08-05 | N/A |
| Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart. | ||||
| CVE-2026-50527 | 4 Apple, Linux, Microsoft and 1 more | 21 Macos, Linux Kernel, .net and 18 more | 2026-08-05 | 7.5 High |
| Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-15714 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-08-05 | 6.5 Medium |
| An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata. | ||||
| CVE-2026-15314 | 1 Tp-link | 3 P110 V1, Tapo P110, Tapo P110 Firmware | 2026-08-05 | 7.5 High |
| Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition. | ||||
| CVE-2017-20241 | 1 Keysight | 1 Ixchariot | 2026-08-05 | 9.8 Critical |
| Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code. | ||||
| CVE-2017-20242 | 1 Keysight | 1 Ixchariot | 2026-08-05 | 9.8 Critical |
| Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code. | ||||
| CVE-2026-49435 | 1 Keysight | 5 Hawkeye, Ixbypass, Ixchariot and 2 more | 2026-08-05 | 9.8 Critical |
| Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges. | ||||
| CVE-2026-58529 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-05 | 7.1 High |
| Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-50524 | 4 Apple, Linux, Microsoft and 1 more | 8 Macos, Linux Kernel, .net and 5 more | 2026-08-05 | 7.5 High |
| Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-18738 | 1 Shlink | 1 Shlink | 2026-08-05 | 4.7 Medium |
| Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas. | ||||
| CVE-2026-24080 | 1 Qualcomm | 73 Cologne, Cologne Firmware, Fastconnect 6700 and 70 more | 2026-08-05 | 7.8 High |
| Memory Corruption when handling malformed request parameters in the fingerprint TA. | ||||
| CVE-2026-25288 | 1 Qualcomm | 109 Cologne, Cologne Firmware, Cq7790 and 106 more | 2026-08-05 | 7.4 High |
| Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | ||||
| CVE-2026-25289 | 1 Qualcomm | 403 Ar8035, Ar8035 Firmware, Cologne and 400 more | 2026-08-05 | 9.6 Critical |
| Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. | ||||
| CVE-2026-53703 | 2 Gstreamer, Redhat | 4 Gstreamer, Enterprise Linux, Enterprise Linux Eus and 1 more | 2026-08-05 | 7.1 High |
| A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure. | ||||
| CVE-2026-51218 | 1 Davenardella | 1 Snap7 | 2026-08-05 | 7.5 High |
| A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet. | ||||
| CVE-2026-51219 | 1 Mz-automation | 1 Lib60870 | 2026-08-05 | 7.5 High |
| A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload. | ||||
| CVE-2026-43817 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-08-05 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-64544 | 1 Linux | 1 Linux Kernel | 2026-08-05 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages. BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure. | ||||