CVE-2026-65122 | Medium | 5.5 | 2026-10-06 | NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of se… |
CVE-2026-19029 | | | 2026-10-06 | A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (applicatio… |
CVE-2026-96399 | | | 2026-10-06 | A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue re… |
CVE-2026-102164 | Low | 3.1 | 2026-10-06 | On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client assoc… |
CVE-2026-106399 | | | 2026-10-06 | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a craf… |
CVE-2026-106304 | | | 2026-10-06 | Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-106284 | | | 2026-10-06 | Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and lev… |
CVE-2026-106026 | Low | 3.7 | 2026-10-06 | tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Un… |
CVE-2026-105838 | Medium | 5.5 | 2026-10-06 | libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap me… |
CVE-2026-75819 | | | 2026-10-06 | GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset… |
CVE-2026-105775 | Medium | 4.3 | 2026-10-06 | A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers… |
CVE-2026-104043 | Medium | 5.5 | 2026-10-06 | A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a spe… |
CVE-2026-104042 | Medium | 5.5 | 2026-10-06 | A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a… |
CVE-2026-104037 | Medium | 5.5 | 2026-10-06 | A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder… |
CVE-2026-104030 | Medium | 5.5 | 2026-10-05 | A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication to… |
CVE-2026-104029 | Low | 3.3 | 2026-10-05 | A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to im… |
CVE-2026-59782 | | | 2026-10-05 | The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resu… |
CVE-2026-105251 | Medium | 6.3 | 2026-10-05 | A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of t… |
CVE-2026-20534 | Medium | 5.3 | 2026-10-05 | In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogu… |
CVE-2026-105164 | Low | 2.7 | 2026-10-04 | A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. Thi… |
CVE-2026-104433 | High | 7.5 | 2026-10-03 | Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated… |
CVE-2026-79896 | High | 7.5 | 2026-10-01 | Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker c… |
CVE-2026-103678 | Medium | 5.4 | 2026-10-01 | A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data… |
CVE-2026-103641 | Medium | 5.5 | 2026-10-01 | A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared… |
CVE-2026-80490 | | | 2026-09-30 | Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified.
The matches, first_match and match… |
CVE-2026-47592 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read… |
CVE-2026-47576 | High | 7.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bounds read. Successful… |
CVE-2026-47545 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A succes… |
CVE-2026-47544 | Medium | 6.7 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful e… |
CVE-2026-47536 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful e… |
CVE-2026-47535 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of… |
CVE-2026-47527 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful expl… |
CVE-2026-47524 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A succes… |
CVE-2026-47521 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful e… |
CVE-2026-47520 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful e… |
CVE-2026-47519 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful e… |
CVE-2026-47515 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read via an unboun… |
CVE-2026-47513 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel h… |
CVE-2026-47512 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to ke… |
CVE-2026-47499 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A succ… |
CVE-2026-102717 | High | 7.5 | 2026-09-30 | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
CVE-2026-102318 | Medium | 4.7 | 2026-09-29 | Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-102820 | Medium | 6.2 | 2026-09-29 | pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pag… |
CVE-2026-102757 | | | 2026-09-29 | An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that t… |
CVE-2026-102726 | | | 2026-09-29 | Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read |
CVE-2026-102725 | | | 2026-09-29 | Out-of-bounds Read from Unvalidated MSRP Attribute List Length |
CVE-2026-102721 | | | 2026-09-29 | A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the
received datagram.
Each receive path checks only that… |
CVE-2026-102720 | | | 2026-09-29 | A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a
kilobyte past the end of the received message.
The opt… |
CVE-2026-102718 | | | 2026-09-29 | hey,
`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID u… |
CVE-2026-102714 | | | 2026-09-29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one… |
CVE-2026-102713 | | | 2026-09-29 | The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than
four bytes (nxd_tftp_server.c:1037) and nothing anywhere… |
CVE-2026-102712 | | | 2026-09-29 | On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the
ciphersuite-list length against the total record lengt… |
CVE-2026-102711 | | | 2026-09-29 | Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_tx… |
CVE-2026-102560 | High | 8.6 | 2026-09-29 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GBy… |
CVE-2026-102559 | High | 8.6 | 2026-09-29 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation A… |
CVE-2026-102558 | High | 8.6 | 2026-09-29 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-c… |
CVE-2026-102555 | High | 8.2 | 2026-09-29 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base… |
CVE-2026-102557 | High | 8.6 | 2026-09-29 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the l… |
CVE-2026-84782 | High | 8.2 | 2026-09-29 | Issue summary: The DTLS retransmission logic does not correctly handle
a handshake message write that is suspended part-way through.
The retransmitted message… |
CVE-2026-102567 | Medium | 6.1 | 2026-09-29 | CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators… |
CVE-2026-102521 | High | 8.6 | 2026-09-29 | The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past t… |
CVE-2026-102360 | High | 8.6 | 2026-09-29 | A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read… |
CVE-2026-102507 | Medium | 5.7 | 2026-09-29 | Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a comp… |
CVE-2026-95509 | | | 2026-09-29 | Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bou… |
CVE-2026-96423 | Medium | 5.5 | 2026-09-29 | X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-18747 | Medium | 6.8 | 2026-09-29 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing… |
CVE-2026-101205 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out… |
CVE-2026-101204 | Medium | 6.3 | 2026-09-28 | A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. Th… |
CVE-2026-18416 | Low | 3.7 | 2026-09-28 | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Que… |
CVE-2026-85644 | High | 7.5 | 2026-09-28 | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.
The wrapper function XS::Parse::Infix generates for a list-ass… |
CVE-2026-94285 | Medium | 5.1 | 2026-09-28 | An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. |
CVE-2026-94284 | Medium | 5.5 | 2026-09-28 | An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attac… |
CVE-2026-94283 | Medium | 6.5 | 2026-09-28 | An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash att… |
CVE-2026-94282 | Medium | 5.6 | 2026-09-28 | An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X clien… |
CVE-2026-100505 | Medium | 4.4 | 2026-09-26 | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UT… |
CVE-2026-92842 | Medium | 5.9 | 2026-09-25 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is… |
CVE-2026-100387 | High | 8.1 | 2026-09-25 | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users t… |
CVE-2026-93682 | Medium | 5.8 | 2026-09-25 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end o… |
CVE-2026-93306 | High | 7.1 | 2026-09-25 | IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulne… |
CVE-2026-98053 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Refactor and fix init_config access
Existing code accesses enties found… |
CVE-2026-81508 | Medium | 4.3 | 2026-09-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_me… |
CVE-2026-94281 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. |
CVE-2026-93545 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. |
CVE-2026-93544 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client. |
CVE-2026-93543 | High | 7.4 | 2026-09-24 | An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. |
CVE-2026-93542 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X… |
CVE-2026-26054 | | | 2026-09-24 | SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen… |
CVE-2026-93541 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a |
CVE-2026-88369 | High | 7.3 | 2026-09-24 | zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump(). |
CVE-2026-88358 | Medium | 6.5 | 2026-09-24 | simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final s… |
CVE-2026-58004 | High | 8.1 | 2026-09-24 | Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: thro… |
CVE-2026-18870 | Medium | 4.3 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remot… |
CVE-2026-97059 | High | 8.2 | 2026-09-24 | DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length… |
CVE-2026-77797 | Low | 3.6 | 2026-09-24 | Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. |
CVE-2026-18857 | Low | 3.4 | 2026-09-24 | IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware manage… |
CVE-2026-81645 | Medium | 5.9 | 2026-09-24 | Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
CVE-2026-96546 | Low | 2.5 | 2026-09-23 | A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in pe… |
CVE-2026-96545 | Medium | 4.4 | 2026-09-23 | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the fi… |
CVE-2026-88840 | Medium | 5.3 | 2026-09-23 | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
CVE-2026-88835 | Medium | 6.1 | 2026-09-23 | BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |