Export limit exceeded: 11565 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 14426 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15540 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10926 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 28089 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28089 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-98158 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ppp_async: drop the errored frame instead of resetting its headroom ppp_receive_nonmp_frame() prepends a two-byte direction tag before running the pass/active BPF filters: *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG); Nothing on the receive path guarantees those two bytes of headroom. The frame-error path in ppp_async's process_input_packet() resets a reused skb's headroom to zero while claiming to restore it to a freshly allocated state - but a fresh skb from dev_alloc_skb() carries NET_SKB_PAD: err: if (skb) { /* make skb appear as freshly allocated */ skb_trim(skb, 0); skb_reserve(skb, - skb_headroom(skb)); } ap->rpkt still points at that skb, so the next frame is reassembled into it with no headroom at all. A peer that sends a bad-FCS frame followed by one beginning ff 03 then leaves a single byte of headroom by the time the filter tag is pushed, which lands one byte below skb->head: skbuff: skb_under_panic: len:49 put:2 head:ffff888003c10000 data:ffff888003c0ffff tail:0x30 end:0x640 dev:<NULL> kernel BUG at net/core/skbuff.c:214! RIP: 0010:skb_panic+0x13e/0x230 Call Trace: skb_push+0xbd/0x100 ppp_receive_nonmp_frame+0x48a/0x1d10 ppp_input+0x4e9/0x2f80 ppp_async_process+0x2a/0xe0 tasklet_action_common+0x20f/0x8a0 handle_softirqs+0x18e/0x590 Kernel panic - not syncing: Fatal exception in interrupt Zeroing the headroom violates the NET_SKB_PAD guarantee that dev_alloc_skb() gives the rest of the receive path. Besides the filter panic above, when CCP compression is enabled ppp_decompress_frame() hands skb->data - 2 to ->decompress()/->incomp(), which then reads out of bounds before skb->head for the same reason. Rather than restore the headroom, drop the errored frame - as ppp_synctty already does on its error path - and clear ap->rpkt so the next frame is reassembled into a fresh skb with proper headroom. This is simpler and fixes both the filter under-panic and the CCP out-of-bounds read. The original V1 of this patch made room in ppp_receive_nonmp_frame() with skb_cow_head(); Eric pointed out that fixing the root cause in the transport is the right approach. Found by fuzzing the PPP receive path with a mutating peer on a pty; it is an interesting (remote) DoS: root configures PPP, the peer supplies two crashing frames. The reproducer (repro-ppp-skb.c, unchanged from v1) panics in about a second, and returns cleanly with this applied. | ||||
| CVE-2026-102189 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-20 | 7 High |
| Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-98155 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker(). | ||||
| CVE-2026-43849 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. | ||||
| CVE-2026-43846 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. | ||||
| CVE-2026-96995 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-20 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102199 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 6.5 Medium |
| Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-101201 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-10-20 | 5.5 Medium |
| A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. | ||||
| CVE-2026-58379 | 2 Gimp, Redhat | 6 Gimp, Enterprise Linux, Enterprise Linux Eus and 3 more | 2026-10-20 | 7.3 High |
| A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory. | ||||
| CVE-2026-43837 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. | ||||
| CVE-2026-100203 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-20 | 7 High |
| Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-100215 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-20 | 7.8 High |
| Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-100216 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-20 | 7 High |
| Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-43855 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | ||||
| CVE-2026-111124 | 1 Nasa | 1 Cfitsio | 2026-10-20 | 6.1 Medium |
| CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels. | ||||
| CVE-2026-112392 | 1 Python-pillow | 1 Pillow | 2026-10-20 | 7.5 High |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-97776 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft Office 365 For Mac and 10 more | 2026-10-20 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85820 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 7.8 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112896 | 1 Python-pillow | 1 Pillow | 2026-10-20 | 8.2 High |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112373 | 1 H3c | 2 Magic Nx15, Magic Nx15 Firmware | 2026-10-20 | 6.5 Medium |
| A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. | ||||