CVE-2026-70457 | Medium | 6.5 | 2026-08-13 | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segm… |
CVE-2026-42170 | High | 7.8 | 2026-08-08 | A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but se… |
CVE-2026-42169 | High | 7.3 | 2026-08-04 | A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, le… |
CVE-2026-45812 | Medium | 6.5 | 2026-07-24 | Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event.
When a single HCI advertising report… |
CVE-2026-65706 | High | 7.8 | 2026-07-23 | FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by… |
CVE-2026-65705 | High | 7.8 | 2026-07-23 | FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by… |
CVE-2026-45784 | High | 7.1 | 2026-07-17 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher… |
CVE-2026-55827 | High | 7.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass de… |
CVE-2026-0280 | High | 7.2 | 2026-07-09 | An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security… |
CVE-2026-54696 | Low | 3.7 | 2026-06-30 | Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an o… |
CVE-2026-53143 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
The v11 MQD man… |
CVE-2026-2050 | High | 7.8 | 2026-06-24 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-53091 | High | 8.4 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects head… |
CVE-2026-52955 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode()
A message of type CEPH_MSG_… |
CVE-2026-42055 | High | 8.1 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the prox… |
CVE-2026-8357 | High | 7.8 | 2026-06-15 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening t… |
CVE-2026-46521 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compre… |
CVE-2026-2049 | High | 7.8 | 2026-06-10 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-11604 | Medium | 6.5 | 2026-06-10 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigg… |
CVE-2026-49841 | Critical | 9.8 | 2026-06-09 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2026-42915 | Medium | 5.5 | 2026-06-09 | Incorrect calculation of buffer size in Windows VMSwitch allows an authorized attacker to deny service locally. |
CVE-2026-10701 | High | 7.5 | 2026-06-02 | Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3. |
CVE-2026-44420 | High | 8.8 | 2026-05-29 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's… |
CVE-2026-43501 | Critical | 9.8 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decomp… |
CVE-2026-42945 | High | 8.1 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed b… |
CVE-2026-40618 | High | 7.5 | 2026-05-13 | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms… |
CVE-2026-44223 | Medium | 6.5 | 2026-05-12 | vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer… |
CVE-2026-43302 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Set DMA segment size to avoid debug warnings
When using V3D rendering with CONFI… |
CVE-2026-43107 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
xfrm: account XFRMA_IF_ID in aevent size calculation
xfrm_get_ae() allocates the reply sk… |
CVE-2026-29004 | High | 8.1 | 2026-05-04 | BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dh… |
CVE-2026-41676 | High | 7.5 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = b… |
CVE-2026-1949 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service. |
CVE-2026-41197 | | | 2026-04-23 | Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses… |
CVE-2026-6752 | High | 7.3 | 2026-04-21 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, an… |
CVE-2026-29645 | High | 7.5 | 2026-04-20 | NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctl… |
CVE-2026-27820 | Critical | 9.8 | 2026-04-16 | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vuln… |
CVE-2026-40918 | Medium | 5.5 | 2026-04-15 | A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack… |
CVE-2026-4152 | High | 7.8 | 2026-04-11 | GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-39892 | Critical | 9.8 | 2026-04-08 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffe… |
CVE-2026-20911 | Critical | 9.8 | 2026-04-07 | A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted mali… |
CVE-2026-34986 | High | 7.5 | 2026-04-06 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… |
CVE-2026-33987 | High | 7.1 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c… |
CVE-2026-33986 | High | 7.5 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h2… |
CVE-2026-33985 | Medium | 5.9 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potential… |
CVE-2026-33984 | High | 7.5 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size i… |
CVE-2025-33216 | Medium | 6.8 | 2026-03-24 | NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculation of buffer size by… |
CVE-2026-4695 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Th… |
CVE-2019-25555 | Medium | 6.2 | 2026-03-21 | TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Script Recorder component that allows local attackers to crash the application… |
CVE-2026-31970 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading fu… |
CVE-2026-31806 | Critical | 9.8 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent… |
CVE-2026-28686 | Medium | 6.8 | 2026-03-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow… |
CVE-2026-20049 | High | 7.7 | 2026-03-04 | A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptiv… |
CVE-2026-2047 | High | 7.8 | 2026-02-20 | GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-2738 | | | 2026-02-19 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag… |
CVE-2026-26200 | High | 7.8 | 2026-02-19 | HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer ov… |
CVE-2025-33124 | Medium | 6.5 | 2026-02-17 | IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a… |
CVE-2026-1188 | Critical | 9.8 | 2026-01-29 | In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounti… |
CVE-2026-22791 | Medium | 6.6 | 2026-01-13 | openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP… |
CVE-2026-21503 | Medium | 6.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2025-62550 | High | 8.8 | 2025-12-09 | Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network. |
CVE-2025-66216 | Critical | 9.8 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-… |
CVE-2025-61661 | Medium | 4.8 | 2025-11-18 | A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when… |
CVE-2025-27074 | High | 8.8 | 2025-11-04 | Memory corruption while processing a GP command response. |
CVE-2025-33126 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1… |
CVE-2025-27053 | High | 7.8 | 2025-10-09 | Memory corruption during PlayReady APP usecase while processing TA commands. |
CVE-2025-57807 | Low | 3.8 | 2025-09-05 | ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functio… |
CVE-2025-55297 | High | 8.8 | 2025-08-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas… |
CVE-2025-52955 | Medium | 6.5 | 2025-07-11 | An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent… |
CVE-2025-27042 | High | 7.8 | 2025-07-08 | Memory corruption while processing video packets received from video firmware. |
CVE-2025-46723 | | | 2025-05-02 | OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte de… |
CVE-2025-46688 | Medium | 5.6 | 2025-04-27 | quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is… |
CVE-2025-46393 | Low | 2.9 | 2025-04-23 | In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary orde… |
CVE-2025-43965 | Low | 2.9 | 2025-04-23 | In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. |
CVE-2025-1861 | Critical | 9.8 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an… |
CVE-2025-30334 | Medium | 6.5 | 2025-03-20 | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. |
CVE-2025-0395 | Medium | 6.2 | 2025-01-22 | When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and siz… |
CVE-2024-11425 | High | 7.5 | 2025-01-17 | CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the
product when an unauthenticated user is sending a… |
CVE-2024-8361 | High | 7.5 | 2025-01-07 | In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subs… |
CVE-2017-13315 | High | 7.8 | 2024-11-19 | In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to an elevation of priv… |
CVE-2024-49776 | Medium | 6.5 | 2024-11-14 | A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file. |
CVE-2024-28052 | Medium | 5.3 | 2024-10-30 | The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aiming to be easy to c… |
CVE-2024-46729 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix incorrect size calculation for loop
[WHY]
fe_clk_en has size of 5 bu… |
CVE-2024-46684 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved:
binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
create_elf_fdpic_t… |
CVE-2024-39808 | Medium | 4.6 | 2024-09-11 | Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Con… |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2022-48889 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: sof-nau8825: fix module alias overflow
The maximum name length for a platfor… |
CVE-2024-43843 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
We get the size of th… |
CVE-2024-42259 | High | 7.8 | 2024-08-14 | In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
Calculating the size of t… |
CVE-2024-5000 | High | 7.5 | 2024-06-04 | An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorr… |
CVE-2024-30405 | High | 7.5 | 2024-04-12 | An Incorrect Calculation of Buffer Size vulnerability in Juniper Networks Junos OS SRX 5000 Series devices using SPC2 line cards while ALGs are enabled allows… |
CVE-2024-26752 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved:
l2tp: pass correct message length to ip6_append_data
l2tp_ip6_sendmsg needs to avoid acco… |
CVE-2024-26721 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address
Commit bd077259d0… |
CVE-2024-27237 | Medium | 5.5 | 2024-03-11 | In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local information disclos… |
CVE-2023-52558 | High | 7.5 | 2024-03-01 | In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after r… |
CVE-2023-52557 | High | 7.5 | 2024-03-01 | In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.
|
CVE-2023-50736 | Critical | 9.0 | 2024-02-28 | A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker t… |
CVE-2021-46943 | High | 7.8 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved:
media: staging/intel-ipu3: Fix set_fmt error handling
If there in an error during a set_f… |
CVE-2024-23606 | Critical | 9.8 | 2024-02-20 | An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A special… |
CVE-2024-23805 | High | 7.5 | 2024-02-14 |
Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when… |
CVE-2023-6387 | High | 7.5 | 2024-02-02 | A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execu… |