CVE-2026-73252 | High | 7.5 | 2026-10-14 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3… |
CVE-2026-86566 | Medium | 6.5 | 2026-10-14 | A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vh… |
CVE-2026-106464 | | | 2026-10-14 | `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A… |
CVE-2026-75083 | Medium | 5.9 | 2026-10-14 | The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z… |
CVE-2026-101980 | Critical | 9.8 | 2026-10-14 | An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker t… |
CVE-2026-101968 | Medium | 5.4 | 2026-10-14 | An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX… |
CVE-2026-101938 | Medium | 6.5 | 2026-10-14 | An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent un… |
CVE-2026-110714 | Medium | 6.5 | 2026-10-14 | libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted… |
CVE-2026-50216 | Medium | 5.3 | 2026-10-14 | An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for m… |
CVE-2026-88964 | | | 2026-10-13 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or mem… |
CVE-2026-97746 | High | 8.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-97739 | High | 8.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-97004 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-96925 | Medium | 5.5 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-96844 | High | 8.0 | 2026-10-13 | Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-88195 | Medium | 6.5 | 2026-10-13 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-88143 | Medium | 6.7 | 2026-10-13 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-85806 | Critical | 9.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-85339 | High | 8.8 | 2026-10-13 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
CVE-2026-83869 | Critical | 9.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-83855 | High | 7.5 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. |
CVE-2026-83838 | High | 8.0 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-83836 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally. |
CVE-2026-83676 | High | 7.0 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-83578 | Critical | 9.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. |
CVE-2026-70064 | High | 7.8 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
CVE-2026-102192 | High | 7.5 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. |
CVE-2026-100222 | Critical | 9.8 | 2026-10-13 | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-88833 | Medium | 6.5 | 2026-10-13 | A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled… |
CVE-2026-65200 | Low | 3.5 | 2026-10-13 | The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transpo… |
CVE-2026-102073 | High | 8.2 | 2026-10-13 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2026-58249 | High | 7.5 | 2026-10-13 | SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauth… |
CVE-2026-58242 | Low | 3.5 | 2026-10-13 | SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploit… |
CVE-2026-53922 | Medium | 6.5 | 2026-10-12 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can firs… |
CVE-2026-109246 | Medium | 6.5 | 2026-10-12 | FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stor… |
CVE-2026-107794 | | | 2026-10-10 | ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.
The OUTPUT typemaps call av_extend( av, len-1 ). On an e… |
CVE-2013-10076 | | | 2026-10-10 | ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list.
The OUTPUT typemaps call av_extend( av, len-1 ). On an… |
CVE-2026-103636 | | | 2026-10-10 | Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
var_opt_union::deserialize() read the 32-byte prea… |
CVE-2026-75352 | High | 7.5 | 2026-10-09 | OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to c… |
CVE-2026-107836 | | | 2026-10-09 | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoA… |
CVE-2026-106437 | Medium | 6.2 | 2026-10-08 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can… |
CVE-2026-106429 | Medium | 6.5 | 2026-10-08 | An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This c… |
CVE-2026-107635 | Medium | 5.5 | 2026-10-08 | Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via c… |
CVE-2026-107614 | Medium | 6.1 | 2026-10-08 | An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash… |
CVE-2026-19186 | High | 8.1 | 2026-10-07 | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without… |
CVE-2026-83742 | High | 8.8 | 2026-10-07 | Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote a… |
CVE-2026-102168 | Medium | 6.5 | 2026-10-06 | On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the… |
CVE-2026-84411 | Critical | 9.8 | 2026-10-02 | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authenticatio… |
CVE-2026-86537 | | | 2026-10-02 | Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bi… |
CVE-2026-82459 | | | 2026-10-02 | Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
This issue affects Apache Thrift: be… |
CVE-2026-47585 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of… |
CVE-2026-47540 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A success… |
CVE-2026-86133 | High | 7.5 | 2026-09-30 | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to cr… |
CVE-2026-86132 | High | 7.5 | 2026-09-30 | An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending… |
CVE-2026-102714 | | | 2026-09-29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one… |
CVE-2026-18747 | Medium | 6.8 | 2026-09-29 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing… |
CVE-2026-88377 | Medium | 6.2 | 2026-09-24 | Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom wit… |
CVE-2026-88376 | High | 7.5 | 2026-09-24 | Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avc… |
CVE-2026-17504 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-95958 | Low | 3.3 | 2026-09-23 | A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component P… |
CVE-2026-81881 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable beca… |
CVE-2026-94090 | Medium | 6.3 | 2026-09-20 | A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the compo… |
CVE-2026-61720 | Medium | 6.2 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk… |
CVE-2026-93599 | High | 7.5 | 2026-09-18 | rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input gu… |
CVE-2026-93395 | Medium | 5.3 | 2026-09-17 | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length pre… |
CVE-2026-44235 | Medium | 6.5 | 2026-09-17 | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during clie… |
CVE-2026-91103 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-89028 | High | 7.5 | 2026-09-16 | MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap… |
CVE-2026-91948 | High | 7.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is… |
CVE-2026-90996 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) respo… |
CVE-2026-13326 | | | 2026-09-11 | An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure… |
CVE-2026-81977 | Medium | 5.5 | 2026-09-08 | Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leve… |
CVE-2026-66307 | High | 7.5 | 2026-09-08 | Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network. |
CVE-2026-78453 | Medium | 6.5 | 2026-09-08 | Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. |
CVE-2026-77488 | Medium | 5.5 | 2026-09-08 | Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally. |
CVE-2026-72947 | Medium | 6.4 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-71352 | High | 8.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network. |
CVE-2026-69859 | High | 7.0 | 2026-09-08 | Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-69824 | Critical | 9.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network. |
CVE-2026-69687 | High | 7.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-69421 | High | 7.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-69303 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally. |
CVE-2026-69276 | Critical | 9.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network. |
CVE-2026-69269 | High | 7.8 | 2026-09-08 | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. |
CVE-2026-68827 | High | 8.0 | 2026-09-08 | Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network. |
CVE-2026-66767 | High | 7.7 | 2026-09-08 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a p… |
CVE-2026-18355 | High | 7.5 | 2026-09-07 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read fr… |
CVE-2026-18341 | Medium | 6.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow. |
CVE-2026-85436 | High | 7.5 | 2026-09-03 | MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap me… |
CVE-2026-9624 | | | 2026-09-01 | A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data… |
CVE-2026-9622 | | | 2026-09-01 | A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic servic… |
CVE-2026-82480 | High | 7.4 | 2026-08-30 | A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/f… |
CVE-2026-54754 | Critical | 9.6 | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderDa… |
CVE-2026-82250 | Medium | 6.5 | 2026-08-28 | gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines w… |
CVE-2026-78011 | | | 2026-08-28 | An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) cond… |
CVE-2026-19318 | | | 2026-08-28 | A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by se… |
CVE-2026-19317 | | | 2026-08-28 | An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) con… |
CVE-2026-19314 | | | 2026-08-28 | An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) cond… |
CVE-2026-71401 | | | 2026-08-27 | An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total… |
CVE-2026-18916 | High | 7.5 | 2026-08-26 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cl… |