CWE-787 · Out-of-bounds Write (page 7)
Page 7 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28956 | Medium | 6.5 | 2026-05-11 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14… |
CVE-2026-28918 | Medium | 6.5 | 2026-05-11 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, vision… |
CVE-2026-28819 | Medium | 5.4 | 2026-05-11 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sono… |
CVE-2026-41257 | Medium | 5.5 | 2026-05-11 | jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows bey… |
CVE-2026-43500 | High | 7.8 | 2026-05-11 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet ha… |
CVE-2026-8263 | Medium | 4.7 | 2026-05-11 | A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of th… |
CVE-2026-42311 | High | 7.8 | 2026-05-09 | Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially… |
CVE-2026-43362 | High | 8.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write() SMB2_write() places write… |
CVE-2026-43330 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is suppli… |
CVE-2026-39817 | Medium | 5.9 | 2026-05-07 | The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a m… |
CVE-2026-8092 | High | 8.1 | 2026-05-07 | Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we pr… |
CVE-2026-4430 | High | 7.8 | 2026-05-07 | Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue af… |
CVE-2026-40003 | Medium | 5.1 | 2026-05-07 | ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the… |
CVE-2026-7957 | High | 8.8 | 2026-05-06 | Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute… |
CVE-2026-7951 | High | 8.8 | 2026-05-06 | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML p… |
CVE-2026-7950 | Medium | 5.4 | 2026-05-06 | Out of bounds read and write in GFX in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via malicious network tra… |
CVE-2026-7923 | High | 8.3 | 2026-05-06 | Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-7902 | High | 8.8 | 2026-05-06 | Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-7899 | High | 8.8 | 2026-05-06 | Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-0300 | Critical | 9.8 | 2026-05-06 | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthentica… |
CVE-2026-6691 | High | 7.8 | 2026-05-06 | The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authe… |
CVE-2026-43279 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback U… |
CVE-2026-43258 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporad… |
CVE-2026-43250 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can enco… |
CVE-2026-43248 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating thes… |
CVE-2026-43208 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS… |
CVE-2026-43206 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() func… |
CVE-2026-43205 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr… |
CVE-2026-43186 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __… |
CVE-2026-43166 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose star… |
CVE-2026-43158 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both t… |
CVE-2026-43150 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax abo… |
CVE-2026-43125 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is n… |
CVE-2026-43078 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignmen… |
CVE-2026-43075 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free w… |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-36355 | High | 7.7 | 2026-05-05 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the wri… |
CVE-2026-25266 | Medium | 5.5 | 2026-05-04 | Memory corruption while processing IOCTL command when device is in power-save state. |
CVE-2025-47404 | Medium | 6.5 | 2026-05-04 | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
CVE-2026-7372 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-42370 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-42369 | Critical | 10.0 | 2026-05-04 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application a… |
CVE-2026-37457 | High | 7.5 | 2026-05-01 | An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attac… |
CVE-2026-43047 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a… |
CVE-2026-43037 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. … |
CVE-2026-43020 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provid… |
CVE-2026-31780 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesi… |
CVE-2026-31772 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_creat… |
CVE-2026-31748 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads… |
CVE-2026-31747 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads… |
CVE-2026-31743 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation… |
CVE-2026-31720 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->… |
CVE-2026-7582 | Medium | 5.3 | 2026-05-01 | A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/dd… |
CVE-2026-42484 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute ar… |
CVE-2026-42483 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code v… |
CVE-2026-42482 | Critical | 9.8 | 2026-05-01 | A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cause a denial of serv… |
CVE-2026-31716 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec->used in journal-replay file record check check_file_record() vali… |
CVE-2026-31712 | High | 8.3 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check… |
CVE-2026-31707 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expe… |
CVE-2026-31705 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte… |
CVE-2026-31699 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving… |
CVE-2026-31698 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retri… |
CVE-2026-31697 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving… |
CVE-2026-31696 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_prepars… |
CVE-2026-5405 | High | 7.8 | 2026-05-01 | RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-5403 | High | 7.8 | 2026-05-01 | SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-40685 | Medium | 6.5 | 2026-04-30 | In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header… |
CVE-2026-31786 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_v… |
CVE-2026-7426 | High | 8.1 | 2026-04-29 | Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent net… |
CVE-2026-41220 | High | 7.8 | 2026-04-29 | Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acro… |
CVE-2026-7354 | High | 8.8 | 2026-04-28 | Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-7323 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7322 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-5435 | High | 7.3 | 2026-04-28 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, an… |
CVE-2026-31690 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-41907 | High | 7.5 | 2026-04-24 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range wri… |
CVE-2026-41678 | High | 8.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it check… |
CVE-2026-41676 | High | 7.5 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = b… |
CVE-2026-31631 | High | 8.2 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Fix rxgk_do_verify_authentic… |
CVE-2026-31607 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receive… |
CVE-2026-33317 | High | 8.7 | 2026-04-24 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-41990 | Medium | 4.0 | 2026-04-23 | Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data. |
CVE-2026-41989 | Medium | 6.7 | 2026-04-23 | Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt. |
CVE-2026-26354 | High | 8.1 | 2026-04-22 | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3… |
CVE-2018-25271 | Medium | 6.2 | 2026-04-22 | Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string th… |
CVE-2018-25268 | High | 8.4 | 2026-04-22 | LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the… |
CVE-2018-25267 | Medium | 6.2 | 2026-04-22 | UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwr… |
CVE-2018-25266 | Medium | 6.2 | 2026-04-22 | Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an… |
CVE-2018-25265 | High | 8.4 | 2026-04-22 | LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structu… |
CVE-2018-25262 | Medium | 6.2 | 2026-04-22 | Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input t… |
CVE-2018-25261 | High | 8.4 | 2026-04-22 | Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute… |
CVE-2018-25260 | High | 8.4 | 2026-04-22 | MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exp… |
CVE-2026-31525 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's si… |
CVE-2026-31521 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn'… |
CVE-2026-31505 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num… |
CVE-2026-31494 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between th… |
CVE-2026-31470 | High | 7.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host cont… |
CVE-2026-31452 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext… |