CVE-2026-20763 | | | 2026-08-11 | Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System s… |
CVE-2026-20270 | High | 8.6 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-10773 | Medium | 5.4 | 2026-08-01 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds… |
CVE-2026-47247 | High | 7.5 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel val… |
CVE-2026-16363 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-55597 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments ca… |
CVE-2026-10512 | High | 7.5 | 2026-06-25 | The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully r… |
CVE-2026-44074 | Low | 3.7 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultane… |
CVE-2026-7836 | Low | 3.1 | 2026-05-21 | An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote authenticated attac… |
CVE-2023-7346 | Medium | 4.0 | 2026-05-20 | Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displa… |
CVE-2026-44498 | High | 7.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-… |
CVE-2026-33487 | High | 7.5 | 2026-03-26 | goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the referenc… |
CVE-2026-28410 | High | 8.1 | 2026-03-05 | The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vestin… |
CVE-2026-1229 | Critical | 9.8 | 2026-02-24 | The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete… |
CVE-2026-25634 | High | 7.8 | 2026-02-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4… |
CVE-2026-24783 | High | 7.5 | 2026-01-27 | soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly hand… |
CVE-2026-0810 | High | 7.1 | 2026-01-26 | A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates… |
CVE-2026-21911 | Medium | 6.5 | 2026-01-15 | An Incorrect Calculation vulnerability in the Layer 2 Control
Protocol
Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated networ… |
CVE-2025-55552 | High | 7.5 | 2025-09-25 | pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. |
CVE-2025-59047 | | | 2025-09-11 | matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` me… |
CVE-2025-54427 | | | 2025-07-28 | Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, mean… |
CVE-2025-5372 | Medium | 5.0 | 2025-07-04 | A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to i… |
CVE-2025-0036 | Low | 3.2 | 2025-06-10 | In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrect… |
CVE-2025-4435 | High | 7.5 | 2025-06-03 | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. Howev… |
CVE-2025-26622 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately… |
CVE-2024-25883 | Medium | 5.3 | 2025-02-06 | The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. |
CVE-2024-11407 | High | 7.5 | 2024-11-26 | There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX… |
CVE-2024-45056 | Medium | 5.9 | 2024-08-29 | zksolc is a Solidity compiler for ZKsync. All LLVM versions since 2015 fold `(xor (shl 1, x), -1)` to `(rotl ~1, x)` if run with optimizations enabled. Here `~… |
CVE-2024-23981 | High | 8.8 | 2024-08-14 | Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user t… |
CVE-2024-42231 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: fix calc_available_free_space() for zoned mode
calc_available_free_space()… |
CVE-2024-41011 | High | 7.8 | 2024-07-18 | In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
We don't get the right… |
CVE-2024-6287 | High | 7.5 | 2024-06-24 | Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.
When checking whether a new image invades/overlaps with a… |
CVE-2024-32873 | Low | 3.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue a… |
CVE-2024-36736 | Critical | 9.8 | 2024-06-06 | An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed. |
CVE-2024-34704 | Medium | 5.9 | 2024-05-14 | era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR… |
CVE-2023-43490 | Medium | 5.3 | 2024-03-14 | Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable… |
CVE-2023-31347 | Medium | 4.9 | 2024-02-13 | Due to a code bug in
Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a
guest to observe an incorrect TSC when Secure TSC is enable… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-35642 | Medium | 6.5 | 2023-12-12 | Internet Connection Sharing (ICS) Denial of Service Vulnerability |
CVE-2023-35641 | High | 8.8 | 2023-12-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-42460 | Medium | 5.3 | 2023-09-27 | Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi… |
CVE-2023-2163 | Critical | 10.0 | 2023-09-20 | Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe
code paths being incorrectly marked as safe, resulting in arbitrary read/write in
kerne… |
CVE-2023-36980 | Medium | 5.3 | 2023-09-11 | An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold. |
CVE-2023-2423 | High | 8.6 | 2023-08-08 |
A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors c… |
CVE-2023-35848 | High | 7.5 | 2023-06-19 | VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member. |
CVE-2023-3161 | Medium | 5.5 | 2023-06-12 | A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since t… |
CVE-2023-28431 | High | 7.5 | 2023-03-22 | Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior t… |
CVE-2023-1296 | Low | 2.7 | 2023-03-14 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. |
CVE-2023-24533 | High | 7.5 | 2023-03-08 | Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this. |
CVE-2023-24532 | Medium | 5.3 | 2023-03-08 | The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than… |
CVE-2023-26488 | Medium | 6.5 | 2023-03-03 | OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update… |
CVE-2022-33972 | Medium | 6.1 | 2023-02-16 | Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially ena… |
CVE-2022-35258 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-36795 | Medium | 5.3 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive… |
CVE-2022-39242 | Medium | 5.3 | 2022-09-24 | Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted… |
CVE-2022-31198 | High | 7.5 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFr… |
CVE-2022-23004 | Medium | 5.3 | 2022-07-29 | When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the l… |
CVE-2022-23003 | Medium | 5.3 | 2022-07-29 | When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly re… |
CVE-2022-23001 | Medium | 5.3 | 2022-07-29 | When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privile… |
CVE-2022-31169 | Medium | 5.9 | 2022-07-22 | Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can resul… |
CVE-2022-31104 | Medium | 4.8 | 2022-06-28 | Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two d… |
CVE-2022-22138 | High | 7.5 | 2022-06-17 | All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V… |
CVE-2022-30780 | High | 7.5 | 2022-06-11 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_mo… |
CVE-2022-30600 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
CVE-2022-29978 | Medium | 6.5 | 2022-05-11 | There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerabi… |
CVE-2022-23066 | Critical | 9.1 | 2022-05-09 | In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead t… |
CVE-2022-26517 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAT Large Scale NAT (… |
CVE-2021-44504 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a size variable, stored as… |
CVE-2021-44491 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3… |
CVE-2021-44490 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3… |
CVE-2022-28048 | High | 8.8 | 2022-04-15 | STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. |
CVE-2022-23628 | Medium | 6.3 | 2022-02-09 | OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes cou… |
CVE-2022-23028 | Medium | 5.3 | 2022-01-25 | On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP… |
CVE-2022-23011 | High | 7.5 | 2022-01-25 | On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffi… |
CVE-2021-45960 | High | 8.8 | 2022-01-01 | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., alloca… |
CVE-2021-44847 | Critical | 9.8 | 2021-12-13 | A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calcul… |
CVE-2021-41222 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies… |
CVE-2021-41122 | Medium | 4.3 | 2021-10-05 | Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The… |
CVE-2021-41329 | Medium | 6.5 | 2021-09-27 | Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This info… |
CVE-2021-34573 | Medium | 6.2 | 2021-09-16 | In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This… |
CVE-2021-29945 | Medium | 6.5 | 2021-06-24 | The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32… |
CVE-2021-31440 | High | 7.0 | 2021-05-21 | This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability t… |
CVE-2020-28393 | High | 7.5 | 2021-05-12 | An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requ… |
CVE-2021-3114 | Medium | 6.5 | 2021-01-26 | In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the fi… |
CVE-2020-26262 | High | 7.2 | 2021-01-13 | Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to… |
CVE-2021-3004 | High | 7.5 | 2021-01-03 | The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacke… |
CVE-2020-26265 | Medium | 5.3 | 2020-12-11 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulner… |
CVE-2020-26241 | Medium | 6.5 | 2020-11-25 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which c… |
CVE-2020-26240 | Medium | 5.3 | 2020-11-25 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 coul… |
CVE-2020-27616 | Medium | 6.5 | 2020-11-06 | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. |
CVE-2020-28030 | High | 7.5 | 2020-11-02 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset a… |
CVE-2020-14422 | Medium | 5.9 | 2020-06-18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to… |
CVE-2020-0221 | Critical | 9.8 | 2020-05-14 | Airbrush FW's scratch memory allocator is susceptible to numeric overflow. When the overflow occurs, the next allocation could potentially return a pointer wit… |
CVE-2020-0022 | High | 8.8 | 2020-02-13 | In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote cod… |
CVE-2019-20051 | Medium | 5.5 | 2019-12-27 | A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95. The vulnerability causes an application crash, which leads to… |
CVE-2019-19578 | High | 8.8 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because o… |
CVE-2019-2232 | High | 7.5 | 2019-12-06 | In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when process… |
CVE-2019-5853 | High | 8.8 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-17514 | High | 7.5 | 2019-10-12 | library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irrep… |
CVE-2019-17264 | Low | 3.3 | 2019-10-06 | In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect… |