Export limit exceeded: 28591 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28591 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-98889 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check. Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes. | ||||
| CVE-2026-98890 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout. | ||||
| CVE-2026-107157 | 1 Qt | 2 Qt, Qtbase | 2026-10-27 | N/A |
| Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information. | ||||
| CVE-2026-98888 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe is preparing or executing its out-of-line single-step instruction. Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable, the same as a hit in KPROBE_REENTER. This is too strict. A hit in KPROBE_HIT_SS is still a one-level reentry and can be handled by saving the current kprobe state and setting up single-step for the new probe, just like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE. The truly unrecoverable case is hitting another kprobe while already in KPROBE_REENTER, because the reentry save area has already been consumed. Move KPROBE_HIT_SS to the recoverable reentry cases and leave KPROBE_REENTER as the unrecoverable nested reentry case. This change also requires saving saved_irqflag in struct prev_kprobe. When a nested kprobe calls kprobes_save_local_irqflag(), it overwrites kcb->saved_irqflag with the currently masked DAIF value, losing the outer kprobe's original DAIF state. Without this fix, when the outer kprobe's single-step finishes, kprobes_restore_local_irqflag() applies the wrong DAIF mask and leaves interrupts permanently disabled. Extend struct prev_kprobe with a saved_irqflag field and save/restore it alongside kp and status. This ensures the outer kprobe's original interrupt state is preserved across reentry. This mirrors the x86 fix in commit 6a5022a56ac3 ("kprobes/x86: Allow to handle reentered kprobe on single-stepping"). | ||||
| CVE-2026-98892 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array. | ||||
| CVE-2026-111147 | 2 Libesedb Project, Libyal | 2 Libesedb, Libesedb | 2026-10-27 | 6.1 Medium |
| Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory. | ||||
| CVE-2026-64767 | 1 Apple | 1 Macos | 2026-10-27 | 9.8 Critical |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sequoia 15.8.2, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-78801 | 2026-10-27 | 4.3 Medium | ||
| An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch | ||||
| CVE-2026-111135 | 2 Libfwsi Project, Libyal | 2 Libfwsi, Libfwsi | 2026-10-27 | 6.1 Medium |
| libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes. | ||||
| CVE-2026-111134 | 2 Libfwsi Project, Libyal | 2 Libfwsi, Libfwsi | 2026-10-27 | 6.1 Medium |
| libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers. | ||||
| CVE-2026-110598 | 2 Libpff Project, Libyal | 2 Libpff, Libpff | 2026-10-27 | 6.1 Medium |
| Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory. | ||||
| CVE-2026-109425 | 2 Google, Tink-crypto | 2 Tink Go, Tink-go | 2026-10-27 | 5.3 Medium |
| Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity. | ||||
| CVE-2026-0993 | 1 Sodola-network | 1 Sl902-swtgw124as Firmware | 2026-10-27 | 7.5 High |
| SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle. | ||||
| CVE-2023-54328 | 1 Aimonesoft | 1 Aimone Video Converter | 2026-10-27 | 6.5 Medium |
| AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload to trigger the denial of service and potentially exploit the software's registration mechanism. | ||||
| CVE-2020-37202 | 1 Nsasoft | 2 Network Sleuth, Nsauditor Networksleuth | 2026-10-27 | 7.5 High |
| NetworkSleuth 3.0.0.0 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to trigger an application crash. | ||||
| CVE-2019-25733 | 1 Nsasoft | 2 Netsharewatcher, Nsauditor Netsharewatcher | 2026-10-27 | 8.4 High |
| NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to trigger code execution when the Find function is invoked. | ||||
| CVE-2026-89208 | 1 Siemens | 15 Capital Embedded Ar Classic 431-422, Capital Embedded Ar Classic R20-11, Desigo Pxc00-e.d and 12 more | 2026-10-26 | 5.3 Medium |
| A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. | ||||
| CVE-2026-103966 | 1 Adobe | 2 Adobe Framemaker 2022, Adobe Framemaker 2026 | 2026-10-26 | 7.8 High |
| Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-73795 | 1 Hpe | 1 Nonstop Tmf Auditread2 | 2026-10-26 | 6.4 Medium |
| A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service. | ||||
| CVE-2026-79830 | 1 Hpe | 1 Nonstop Kernel Level Thread Model Lib | 2026-10-26 | 6.6 Medium |
| A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution. | ||||