Export limit exceeded: 27766 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (27766 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-2845 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-10-09 | 7.8 High |
| Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. | ||||
| CVE-2026-57546 | 1 Qualcomm | 29 Congo, Congo Firmware, Fastconnect 7800 and 26 more | 2026-10-09 | 7.5 High |
| Transient DOS when processing a continuous receive command with a zero-sized global configuration override. | ||||
| CVE-2026-78862 | 1 Mercusys | 1 Ac12 V2 | 2026-10-09 | 6.8 Medium |
| An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB) | ||||
| CVE-2026-105838 | 2 Raphael Assenat, Sezero | 2 Libmikmod, Libmikmod | 2026-10-09 | 5.5 Medium |
| libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications. | ||||
| CVE-2026-105842 | 2 Lrzsz Project, Uwe Ohse | 2 Lrzsz, Lrzsz | 2026-10-09 | 6.4 Medium |
| lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz. | ||||
| CVE-2026-104945 | 1 Tp-link | 1 Tapo C500 V2 | 2026-10-09 | N/A |
| TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts. | ||||
| CVE-2026-76741 | 1 Hewlett Packard Enterprise (hpe) | 1 Aos-switch | 2026-10-09 | 6.5 Medium |
| Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-service condition on the affected system. | ||||
| CVE-2026-76744 | 1 Hewlett Packard Enterprise (hpe) | 1 Aos-switch | 2026-10-09 | 9.8 Critical |
| Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code. | ||||
| CVE-2026-76746 | 1 Hewlett Packard Enterprise (hpe) | 1 Aos-switch | 2026-10-09 | 9.3 Critical |
| An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device. | ||||
| CVE-2026-76747 | 1 Hewlett Packard Enterprise (hpe) | 1 Aos-switch | 2026-10-09 | 9.1 Critical |
| Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device. | ||||
| CVE-2026-102162 | 1 Arista | 1 Wi-fi Access Points | 2026-10-09 | 8.8 High |
| On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts. | ||||
| CVE-2026-102164 | 1 Arista | 1 Wi-fi Access Points | 2026-10-09 | 3.1 Low |
| On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible. | ||||
| CVE-2026-102167 | 1 Arista | 1 Wi-fi Access Points | 2026-10-09 | 7.5 High |
| On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink. | ||||
| CVE-2026-102165 | 1 Arista | 1 Wi-fi Access Points | 2026-10-09 | 7.5 High |
| On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode. | ||||
| CVE-2026-59347 | 1 Vmware | 2 Vmware Fusion, Vmware Workstation | 2026-10-09 | 8.1 High |
| VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1) | ||||
| CVE-2026-107611 | 1 Glavsoft | 1 Tightvnc | 2026-10-09 | 7.1 High |
| An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer. | ||||
| CVE-2026-107614 | 1 Glavsoft | 1 Tightvnc | 2026-10-09 | 6.1 Medium |
| An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place. | ||||
| CVE-2026-107565 | 2 Luksmeta, Redhat | 4 Luksmeta, Enterprise Linux, Openshift and 1 more | 2026-10-09 | 5.1 Medium |
| A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible. | ||||
| CVE-2026-106177 | 1 Hp Inc | 4 Hp Sure Click Enterprise, Hp Wolf Pro Security, Hp Wolf Pro Security Edition and 1 more | 2026-10-09 | 6.4 Medium |
| A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability. | ||||
| CVE-2026-107302 | 1 Mcollina | 1 Msgpack5 | 2026-10-09 | 7.5 High |
| msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0. | ||||