CVE-2026-101014 | High | 7.3 | 2026-09-28 | A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the libr… |
CVE-2026-100889 | High | 7.3 | 2026-09-28 | A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decod… |
CVE-2026-18460 | | | 2026-09-22 | Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Profession… |
CVE-2026-83600 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes… |
CVE-2026-93018 | Medium | 5.5 | 2026-09-18 | Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin… |
CVE-2026-76081 | Medium | 5.5 | 2026-09-14 | ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are delet… |
CVE-2026-90781 | Medium | 4.4 | 2026-09-13 | alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when pars… |
CVE-2026-81396 | High | 7.8 | 2026-09-08 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-69609 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-86297 | High | 8.1 | 2026-09-07 | A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c… |
CVE-2026-81738 | | | 2026-09-07 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries |
CVE-2026-57160 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_… |
CVE-2026-17469 | Medium | 5.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser. |
CVE-2026-85454 | Medium | 6.1 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial… |
CVE-2026-14368 | Medium | 5.4 | 2026-08-31 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-termi… |
CVE-2026-46369 | High | 7.5 | 2026-08-26 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict… |
CVE-2026-65927 | High | 7.5 | 2026-08-25 | Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather tha… |
CVE-2026-79148 | Critical | 9.1 | 2026-08-25 | Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside… |
CVE-2026-68767 | Medium | 6.1 | 2026-08-22 | hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. At… |
CVE-2026-63387 | High | 7.0 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels… |
CVE-2026-55564 | Medium | 5.4 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index… |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-71391 | | | 2026-08-10 | GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph… |
CVE-2026-11771 | High | 7.5 | 2026-07-30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potential… |
CVE-2026-14899 | High | 7.5 | 2026-07-22 | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a singl… |
CVE-2026-44687 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could b… |
CVE-2026-64047 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
When an sk_msg s… |
CVE-2026-50497 | Medium | 6.5 | 2026-07-14 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58380 | High | 7.3 | 2026-07-06 | A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one b… |
CVE-2026-12413 | High | 7.5 | 2026-07-02 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The funct… |
CVE-2026-7831 | High | 7.6 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the… |
CVE-2026-44042 | Low | 3.7 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:81… |
CVE-2026-58374 | Medium | 6.5 | 2026-06-30 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthent… |
CVE-2026-58014 | High | 7.3 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with a… |
CVE-2026-53309 | Critical | 9.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
The local-vs-remote re… |
CVE-2026-53306 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
tty: hvc_iucv: fix off-by-one in number of supported devices
MAX_HVC_IUCV_LINES == HVC_AL… |
CVE-2026-56790 | High | 7.3 | 2026-06-25 | CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remot… |
CVE-2026-56787 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to tr… |
CVE-2026-53263 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix off-by-one in multicast context address compression
The second memcpy in low… |
CVE-2026-52804 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploit… |
CVE-2026-53088 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
The write_ptr points to the next open… |
CVE-2026-53036 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix off-by-one in check_imm signed range check
check_imm(bits, imm) is used i… |
CVE-2026-8357 | High | 7.8 | 2026-06-15 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening t… |
CVE-2026-54410 | High | 8.6 | 2026-06-14 | nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated a… |
CVE-2026-46559 | Medium | 4.0 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in… |
CVE-2026-45380 | Low | 3.6 | 2026-06-10 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in S… |
CVE-2026-45358 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the m… |
CVE-2026-52907 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved:
media: rockchip: rkcif: fix off by one bugs
Change these comparisons from > vs >= to avoi… |
CVE-2026-49127 | High | 8.6 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows… |
CVE-2026-46066 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
ceph: fix num_ops off-by-one when crypto allocation fails
move_dirty_folio_in_page_array(… |
CVE-2026-42015 | Medium | 5.3 | 2026-05-26 | A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the… |
CVE-2026-48689 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hp… |
CVE-2026-44065 | Medium | 4.2 | 2026-05-21 | An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service d… |
CVE-2026-45232 | Low | 3.1 | 2026-05-20 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows… |
CVE-2026-44603 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. |
CVE-2026-7572 | Medium | 4.4 | 2026-05-06 | An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux a… |
CVE-2026-43964 | Low | 3.7 | 2026-05-04 | Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks t… |
CVE-2026-43860 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest. |
CVE-2026-41502 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-st… |
CVE-2026-40254 | Medium | 4.2 | 2026-04-24 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/cl… |
CVE-2026-6861 | Medium | 6.1 | 2026-04-22 | A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS… |
CVE-2026-40312 | Medium | 6.2 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decod… |
CVE-2026-32605 | High | 7.5 | 2026-04-13 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an un… |
CVE-2026-33997 | Medium | 6.8 | 2026-03-31 | Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be… |
CVE-2026-5123 | Low | 3.7 | 2026-03-30 | A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation… |
CVE-2026-22593 | High | 8.4 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificate filename handling causes a stack-based buffer o… |
CVE-2026-4887 | Medium | 6.1 | 2026-03-26 | A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by con… |
CVE-2026-34085 | Medium | 5.9 | 2026-03-25 | fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a cr… |
CVE-2006-10003 | Critical | 9.8 | 2026-03-19 | XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.
In the case (stackptr == stacksize - 1), the stack will… |
CVE-2026-23257 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
In setup_nic_device… |
CVE-2026-23256 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
In setup_nic_device… |
CVE-2026-28520 | High | 8.4 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connect… |
CVE-2026-31988 | Medium | 5.3 | 2026-03-11 | yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLa… |
CVE-2026-26309 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString()… |
CVE-2026-25989 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can… |
CVE-2026-2703 | Low | 3.3 | 2026-02-19 | A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/… |
CVE-2026-21870 | Medium | 5.5 | 2026-02-13 | BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. In 1.4.2, 1.5.0.rc2, and… |
CVE-2025-71161 | High | 7.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved:
dm-verity: disable recursive forward error correction
There are two problems with the rec… |
CVE-2026-23951 | Medium | 5.5 | 2026-01-22 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, cau… |
CVE-2025-71087 | Medium | 5.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved:
iavf: fix off-by-one issues in iavf_config_rss_reg()
There are off-by-one bugs when confi… |
CVE-2026-21504 | Medium | 6.6 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21494 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21491 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21490 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2025-11215 | Medium | 4.3 | 2025-11-06 | Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chro… |
CVE-2022-50428 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix off-by-one errors in fast-commit block filling
Due to several different off-by-… |
CVE-2025-4582 | High | 7.1 | 2025-09-23 | Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers. This issue affects Co… |
CVE-2023-53397 | Medium | 5.5 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved:
modpost: fix off by one in is_executable_section()
The > comparison should be >= to preve… |
CVE-2025-38600 | High | 8.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
The ssid->ssids[] and sreq->ss… |
CVE-2025-54349 | Medium | 6.5 | 2025-08-03 | In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. |
CVE-2025-53014 | Low | 3.7 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overf… |
CVE-2025-52497 | Medium | 4.8 | 2025-07-04 | Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM… |
CVE-2025-47711 | Medium | 6.5 | 2025-06-09 | There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a ve… |
CVE-2023-53143 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzbot figure… |
CVE-2025-23150 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix off-by-one error in do_split
Syzkaller detected a use-after-free issue in ext4_… |
CVE-2025-43973 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are a… |
CVE-2025-43971 | High | 8.6 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. |
CVE-2025-37893 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Fix off-by-one error in build_prologue()
Vincent reported that running BP… |
CVE-2025-30742 | Medium | 5.3 | 2025-03-26 | httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' cha… |
CVE-2024-10442 | Critical | 10.0 | 2025-03-19 | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified… |