Export limit exceeded: 28126 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28126 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-39979 | 2 Jqlang, Redhat | 14 Jq, Ai Inference Server, Ansible Automation Platform and 11 more | 2026-10-26 | 6.5 Medium |
| jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. | ||||
| CVE-2025-55640 | 1 Gpac | 1 Mp4box | 2026-10-26 | 5.5 Medium |
| A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2026-101103 | 1 Hms Networks | 2 Pcan Windows Can Device Drivers, Peak-system Device Driver Setup | 2026-10-26 | 5.5 Medium |
| The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. | ||||
| CVE-2026-103672 | 1 Hms Networks | 2 Pcan Windows Can Device Drivers, Peak-system Device Driver Setup | 2026-10-26 | 7.1 High |
| The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. | ||||
| CVE-2026-42025 | 1 Totolink | 1 X2000r | 2026-10-26 | 9.1 Critical |
| Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter. | ||||
| CVE-2026-63855 | 1 Linux | 1 Linux Kernel | 2026-10-26 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1) | ||||
| CVE-2026-89317 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were. | ||||
| CVE-2026-89319 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error. | ||||
| CVE-2026-115680 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 6.5 Medium |
| Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission | ||||
| CVE-2026-115919 | 1 Onnx | 1 Onnx | 2026-10-26 | 6.2 Medium |
| Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0. | ||||
| CVE-2026-115920 | 1 Onnx | 1 Onnx | 2026-10-26 | 6.2 Medium |
| Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0. | ||||
| CVE-2026-107894 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107896 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107897 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107898 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107899 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107900 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-116487 | 1 Nxp | 1 Mcuxsdk-middleware-usb | 2026-10-26 | 4.6 Medium |
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory. | ||||
| CVE-2026-116488 | 1 Nxp | 1 Mcuxsdk-middleware-usb | 2026-10-26 | 6.8 Medium |
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service. | ||||
| CVE-2026-115906 | 1 Zip-rs | 1 Zip2 | 2026-10-26 | 6.5 Medium |
| zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0. | ||||