Export limit exceeded: 404836 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (5045 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89864 | 1 Linux | 1 Linux Kernel | 2026-09-18 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers struct qla_i2c_access carries a 16-bit length field alongside a fixed 64-byte buffer: struct qla_i2c_access { uint16_t device, offset, option, length; uint8_t buffer[0x40]; } __packed; qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. i2c is overlaid on a 256-byte on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to 65535 overruns both: - write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs i2c->length bytes out of the 256-byte buffer. - read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp, then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte buffer inside the on-stack array. A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the kernel stack. Reject requests whose length exceeds the buffer before any copy or DMA transfer in both handlers. | ||||
| CVE-2026-55209 | 1 Equinor | 1 Resdata | 2026-09-17 | 9.8 Critical |
| resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9. | ||||
| CVE-2023-24283 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a crafted save file. | ||||
| CVE-2023-24284 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. | ||||
| CVE-2023-24285 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. | ||||
| CVE-2023-24286 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. | ||||
| CVE-2023-24287 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. | ||||
| CVE-2023-24291 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter. | ||||
| CVE-2026-16726 | 1 Panasonic | 4 Panaterm For Multi, Panaterm V6, Panaterm V7 and 1 more | 2026-09-17 | N/A |
| Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows. | ||||
| CVE-2026-82770 | 1 Contec | 4 Rp-wah-sr1, Rp-wah-sr12, Rp-wah-sr2 and 1 more | 2026-09-17 | 8.8 High |
| Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed. | ||||
| CVE-2026-76888 | 1 Wireshark | 1 Wireshark | 2026-09-17 | 3.1 Low |
| RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76887 | 1 Wireshark | 1 Wireshark | 2026-09-17 | 3.1 Low |
| Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76883 | 1 Wireshark | 1 Wireshark | 2026-09-17 | 4.7 Medium |
| Catapult DCT2000 file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2025-5222 | 2 Redhat, Unicode | 5 Enterprise Linux, Openshift, Rhel E4s and 2 more | 2026-09-17 | 7 High |
| A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution. | ||||
| CVE-2026-0157 | 1 Google | 1 Android | 2026-09-16 | 4.3 Medium |
| In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-91964 | 1 Freerdp | 1 Freerdp | 2026-09-16 | 8.8 High |
| FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure. | ||||
| CVE-2026-90608 | 1 Totolink | 1 A3002mu | 2026-09-16 | 9.9 Critical |
| A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2025-64031 | 1 Libarchive | 1 Libarchive | 2026-09-16 | 2.5 Low |
| libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.) | ||||
| CVE-2026-90781 | 1 Alsa-project | 1 Alsa-lib | 2026-09-16 | 4.4 Medium |
| alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process. | ||||
| CVE-2026-91953 | 1 Freerdp | 1 Freerdp | 2026-09-16 | 6.5 Medium |
| FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes. | ||||