Export limit exceeded: 410695 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410695 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410695 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77684 | 1 Zephyrproject | 1 Zephyr | 2026-10-20 | 5.7 Medium |
| The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running. The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good. With the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled. | ||||
| CVE-2026-83966 | 1 Adobe | 1 Substance 3d Sampler | 2026-10-20 | 7.8 High |
| Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-83965 | 1 Adobe | 1 Substance 3d Sampler | 2026-10-20 | 7.8 High |
| Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-105899 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-10-20 | 10 Critical |
| ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-105898 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-10-20 | 8.2 High |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-103843 | 1 Adobe | 1 Substance 3d Stager | 2026-10-20 | 7.8 High |
| Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103842 | 1 Adobe | 1 Substance 3d Stager | 2026-10-20 | 7.8 High |
| Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103841 | 1 Adobe | 1 Substance 3d Stager | 2026-10-20 | 7.8 High |
| Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103840 | 1 Adobe | 1 Substance 3d Stager | 2026-10-20 | 7.8 High |
| Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-97838 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-105453 | 1 Ibm | 1 Sterling Connect Direct | 2026-10-19 | 8.4 High |
| IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. | ||||
| CVE-2026-97831 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97828 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96238 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 6.5 Medium |
| Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96237 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.5 High |
| Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96230 | 1 Microsoft | 3 Microsoft.aspnetcore.components.webassembly.server, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 8.8 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96233 | 1 Microsoft | 2 .net, .net Framework | 2026-10-19 | 7.5 High |
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96225 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96231 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70007 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-19 | 8.8 High |
| Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | ||||