CVE-2026-107221 | Medium | 6.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the las… |
CVE-2026-76459 | High | 8.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal securi… |
CVE-2026-106571 | Medium | 5.1 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the Get… |
CVE-2026-106564 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder… |
CVE-2026-19186 | High | 8.1 | 2026-10-07 | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without… |
CVE-2026-15894 | High | 8.8 | 2026-10-07 | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte… |
CVE-2026-103416 | | | 2026-10-07 | Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cac… |
CVE-2026-101258 | High | 7.8 | 2026-10-06 | A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell c… |
CVE-2026-102163 | High | 8.8 | 2026-10-06 | On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can… |
CVE-2026-106401 | Critical | 9.6 | 2026-10-06 | Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-106118 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Cr… |
CVE-2026-106117 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expand… |
CVE-2026-106115 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompresso… |
CVE-2026-106113 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying Histog… |
CVE-2026-106112 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate a… |
CVE-2026-106110 | High | 7.5 | 2026-10-06 | ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit ima… |
CVE-2026-77178 | Critical | 9.1 | 2026-10-06 | Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79… |
CVE-2026-84854 | High | 7.0 | 2026-10-06 | In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amou… |
CVE-2026-25273 | Medium | 6.7 | 2026-10-06 | Memory Corruption when processing camera operations due to out-of-bounds write during driver updates. |
CVE-2026-25272 | Medium | 6.7 | 2026-10-06 | Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. |
CVE-2026-25270 | Medium | 6.7 | 2026-10-06 | Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. |
CVE-2026-25269 | Medium | 6.7 | 2026-10-06 | Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size. |
CVE-2026-25263 | Medium | 6.6 | 2026-10-06 | Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters. |
CVE-2026-104036 | Medium | 5.8 | 2026-10-06 | A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but… |
CVE-2026-0482 | | | 2026-10-05 | In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigg… |
CVE-2026-0461 | | | 2026-10-05 | Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upg… |
CVE-2026-49878 | High | 7.2 | 2026-10-05 | In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote co… |
CVE-2026-59783 | | | 2026-10-05 | The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability… |
CVE-2026-19184 | High | 8.4 | 2026-10-05 | The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of… |
CVE-2026-105248 | Medium | 6.3 | 2026-10-05 | A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the compo… |
CVE-2026-20589 | Medium | 6.7 | 2026-10-05 | In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2026-20588 | Medium | 6.7 | 2026-10-05 | In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has a… |
CVE-2026-20586 | High | 8.8 | 2026-10-05 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution… |
CVE-2026-20579 | Medium | 6.7 | 2026-10-05 | In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2026-20544 | Medium | 6.8 | 2026-10-05 | In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical a… |
CVE-2026-20530 | Medium | 6.7 | 2026-10-05 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20529 | Medium | 6.7 | 2026-10-05 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20528 | Medium | 6.7 | 2026-10-05 | In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, cr… |
CVE-2026-20526 | High | 7.5 | 2026-10-05 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2026-20523 | High | 8.4 | 2026-10-05 | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execu… |
CVE-2026-20522 | High | 8.4 | 2026-10-05 | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execu… |
CVE-2026-20520 | High | 7.5 | 2026-10-05 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2026-20519 | High | 7.5 | 2026-10-05 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a… |
CVE-2026-103628 | Critical | 9.6 | 2026-10-02 | Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-82459 | | | 2026-10-02 | Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
This issue affects Apache Thrift: be… |
CVE-2026-102514 | | | 2026-10-01 | Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier al… |
CVE-2026-103484 | High | 8.8 | 2026-10-01 | IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution. |
CVE-2026-59685 | High | 7.5 | 2026-10-01 | Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded.
This issue affects Apa… |
CVE-2026-56449 | High | 7.5 | 2026-10-01 | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.
This issue affects Apache HTTP Server: from 2.4… |
CVE-2026-56153 | High | 7.5 | 2026-10-01 | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. |
CVE-2026-79900 | Medium | 6.5 | 2026-10-01 | boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the dig… |
CVE-2026-103680 | Low | 3.1 | 2026-10-01 | A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate file… |
CVE-2026-47601 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user… |
CVE-2026-47582 | High | 7.0 | 2026-09-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write. A successful exploit… |
CVE-2026-47575 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attacker may cause an integ… |
CVE-2026-47573 | High | 7.8 | 2026-09-30 | NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead t… |
CVE-2026-47561 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unp… |
CVE-2026-47553 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds write… |
CVE-2026-47548 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A succe… |
CVE-2026-47541 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful… |
CVE-2026-47538 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds write. A successful exp… |
CVE-2026-47537 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploi… |
CVE-2026-47532 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A succe… |
CVE-2026-47530 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A succe… |
CVE-2026-47529 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploi… |
CVE-2026-47523 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A succe… |
CVE-2026-47511 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successfu… |
CVE-2026-47509 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successfu… |
CVE-2026-47503 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an out-of-bounds write b… |
CVE-2026-47501 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched m… |
CVE-2026-47498 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a speci… |
CVE-2026-47496 | High | 7.3 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by… |
CVE-2026-47495 | High | 7.8 | 2026-09-30 | NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A succ… |
CVE-2026-92869 | Medium | 6.5 | 2026-09-30 | An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination. |
CVE-2026-92867 | High | 8.8 | 2026-09-30 | An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code ex… |
CVE-2026-103111 | High | 7.6 | 2026-09-30 | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. |
CVE-2026-103110 | Critical | 9.8 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unp… |
CVE-2026-103109 | High | 7.7 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to tri… |
CVE-2026-81433 | | | 2026-09-30 | A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent n… |
CVE-2026-74225 | High | 7.1 | 2026-09-29 | U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6… |
CVE-2026-71974 | Medium | 4.8 | 2026-09-29 | U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds… |
CVE-2026-71972 | Medium | 5.9 | 2026-09-29 | U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can… |
CVE-2026-71971 | High | 8.2 | 2026-09-29 | U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote a… |
CVE-2026-102301 | High | 8.3 | 2026-09-29 | Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute ar… |
CVE-2026-95357 | Critical | 9.6 | 2026-09-29 | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sa… |
CVE-2026-95331 | Critical | 9.6 | 2026-09-29 | Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-95329 | Critical | 9.6 | 2026-09-29 | Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-95322 | High | 8.3 | 2026-09-29 | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute… |
CVE-2026-95304 | High | 8.8 | 2026-09-29 | Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
CVE-2026-102761 | | | 2026-09-29 | NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound b… |
CVE-2026-102757 | | | 2026-09-29 | An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that t… |
CVE-2026-102730 | | | 2026-09-29 | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation… |
CVE-2026-102729 | | | 2026-09-29 | `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id… |
CVE-2026-102715 | | | 2026-09-29 | Any host on the LAN can send two mDNS records and make the responder write past the end of its
transmit packet.
The string table stores each name in a sl… |
CVE-2026-72897 | High | 7.5 | 2026-09-29 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a
connection to a different SSL_CTX part way through a handshake may access
memory beyond th… |
CVE-2026-63209 | High | 7.5 | 2026-09-29 | compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass… |
CVE-2026-102566 | High | 7.8 | 2026-09-29 | CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size… |
CVE-2026-95520 | High | 7.1 | 2026-09-29 | A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFF… |
CVE-2026-15390 | | | 2026-09-29 | Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP… |
CVE-2026-102474 | Medium | 4.0 | 2026-09-29 | A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six byt… |