Overview 4,592 matches · 9 in Waratek scope · 0 protected · 41 exploited · 24 CISA KEV · 97 public PoC · 38 EPSS ≥ 0.5
4,592matches
9in Waratek scope0.2%
0protected0.0%
41exploited0.9%
24CISA KEV0.5%
97public PoC2.1%
38EPSS ≥ 0.50.8%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
0.2%
Outside Waratek scope
33
0.7%
Not applicable
4,550
99.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
4,592
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 883 / year
19972
Not applicable2
High2
not blocked2
Working exploit published2
19982
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19991
Not applicable1
High1
not blocked1
No public exploit1
20004
Not applicable4
High1
Medium3
not blocked4
No public exploit4
20015
Not applicable5
High4
Medium1
not blocked5
Exploited1
Working exploit published1
No public exploit3
20023
Not applicable3
High3
not blocked3
No public exploit3
20037
Not applicable7
High6
Medium1
not blocked7
Working exploit published6
No public exploit1
20043
Not applicable3
High3
not blocked3
Exploited1
No public exploit2
20051
Not applicable1
High1
not blocked1
No public exploit1
20065
Not applicable5
Critical1
High1
Medium3
not blocked5
Exploited1
No public exploit4
20075
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20087
Not applicable7
High6
Medium1
not blocked7
Exploited1
Working exploit published1
No public exploit5
20095
Not applicable5
High3
Medium1
Low1
not blocked5
Exploited1
Working exploit published2
No public exploit2
201010
Not applicable10
Critical1
High5
Medium4
not blocked10
Exploited1
Working exploit published1
No public exploit8
201115
Not applicable15
High10
Medium4
Low1
not blocked15
Exploited1
No public exploit14
20125
Not applicable5
High3
Medium2
not blocked5
Working exploit published1
No public exploit4
20136
Not applicable6
High6
not blocked6
Exploited2
No public exploit4
20145
Not applicable5
Critical1
High2
Medium2
not blocked5
Forecast only1
No public exploit4
20156
Not applicable6
High5
Medium1
not blocked6
No public exploit6
201616
Not applicable16
Critical4
High8
Medium4
not blocked16
Exploited2
No public exploit14
201740
Outside Waratek scope2
Not applicable38
Critical5
High34
Medium1
not blocked40
Exploited4
Working exploit published1
No public exploit35
201861
Not applicable61
Critical22
High34
Medium5
not blocked61
Exploited1
Working exploit published2
No public exploit58
2019112
Outside Waratek scope8
Not applicable104
Critical44
High61
Medium7
not blocked112
Exploited2
Working exploit published7
Forecast only1
No public exploit102
2020391
Outside Waratek scope5
Not applicable386
Critical142
High175
Medium72
Low2
not blocked391
Exploited5
Working exploit published9
Proof of concept only3
Forecast only2
No public exploit372
2021418
Outside Waratek scope7
Not applicable411
Critical93
High211
Medium110
Low4
not blocked418
Exploited5
Working exploit published2
Proof of concept only8
Forecast only4
No public exploit399
2022460
No exploit published3
Outside Waratek scope5
Not applicable452
Critical174
High236
Medium50
not blocked460
Exploited1
Proof of concept only116
No public exploit343
2023607
No exploit published4
Outside Waratek scope2
Not applicable601
Critical214
High280
Medium113
not blocked607
Exploited6
Working exploit published2
Proof of concept only163
Forecast only1
No public exploit435
2024679
No exploit published1
Outside Waratek scope1
Not applicable677
Critical122
High374
Medium179
Low4
not blocked679
Exploited1
Working exploit published1
Proof of concept only283
No public exploit394
2025828
Outside Waratek scope1
Not applicable827
Critical108
High474
Medium240
Low6
not blocked828
Exploited5
Working exploit published11
Proof of concept only445
No public exploit367
2026883
No exploit published1
Outside Waratek scope2
Not applicable880
Critical102
High560
Medium177
Low44
not blocked883
Working exploit published3
Proof of concept only416
No public exploit464
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-129123 | High | 2026-11-13 | Not applicable | Proof of concept only | C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes. |
| CVE-2026-0436 | Medium | 2026-11-12 | Not applicable | No public exploit | Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service. |
| CVE-2026-124947 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124926 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124924 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124918 | High | 2026-11-10 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124915 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124891 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Selection component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124888 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124887 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124875 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124870 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124868 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124859 | Critical | 2026-11-10 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124856 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124852 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-110088 | High | 2026-11-10 | Not applicable | No public exploit | Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-110087 | Medium | 2026-11-10 | Not applicable | No public exploit | Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-124563 | High | 2026-11-09 | Not applicable | No public exploit | A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-124562 | High | 2026-11-09 | Not applicable | No public exploit | A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-124060 | High | 2026-11-07 | Not applicable | Proof of concept only | A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used. |
| CVE-2026-124059 | High | 2026-11-07 | Not applicable | Proof of concept only | A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. |
| CVE-2026-124058 | High | 2026-11-07 | Not applicable | Proof of concept only | A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-124057 | High | 2026-11-07 | Not applicable | Proof of concept only | A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-123961 | High | 2026-11-07 | Not applicable | Proof of concept only | A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. |
| CVE-2026-123960 | High | 2026-11-07 | Not applicable | Proof of concept only | A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-123959 | High | 2026-11-07 | Not applicable | Proof of concept only | A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-123958 | High | 2026-11-07 | Not applicable | Proof of concept only | A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. |
| CVE-2026-123957 | High | 2026-11-07 | Not applicable | Proof of concept only | A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. |
| CVE-2026-76077 | High | 2026-11-05 | Not applicable | No public exploit | ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1. |
| CVE-2026-48173 | Critical | 2026-11-05 | Not applicable | No public exploit | In the NAS message handler, improper validation of the length field in NAS message causes memory corruption |
| CVE-2026-123199 | Medium | 2026-11-05 | Not applicable | No public exploit | eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened. |
| CVE-2026-87040 | High | 2026-11-04 | Not applicable | No public exploit | The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isr_rx_pdu() in subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding isr_rx() handlers in lll_central_iso.c, lll_peripheral_iso.c, lll_sync_iso.c and lll_scan_aux.c did the same for ISO and extended-advertising PDUs. The nRF radio stores the received header verbatim and truncates only the payload at PCNF1.MAXLEN, so a frame declaring more octets than were configured leaves a node buffer whose len field describes more data than the buffer holds. An attacker within radio range that can emit a hand-crafted link-layer PDU — for a connection, any peer that establishes an unencrypted LE connection to a connectable advertiser; for CONFIG_BT_CTLR_SYNC_ISO, any broadcaster the device is synchronised to — can set the length byte up to 255 while the controller has programmed a much smaller maximum (lll->dle.eff.max_rx_octets, which is 27 until a Data Length Update, or the negotiated cis_lll->rx.max_pdu). No pairing, authentication or user interaction is required. On encrypted links the CCM MIC check normally rejects such a frame first, so the exposure is on unencrypted traffic, which is why the added check is placed after decryption. The unchecked length reaches hci_acl_encode() in subsys/bluetooth/controller/hci/hci.c, which performs net_buf_add(buf, pdu_data->len) followed by a memcpy() of that many bytes out of the node_rx pool element. Because CONFIG_BT_CTLR_DATA_LENGTH_MAX and CONFIG_BT_BUF_ACL_RX_SIZE both default to 27, this is an out-of-bounds read of up to roughly 228 bytes past the received PDU and a corresponding out-of-bounds write past the HCI ACL buffer into neighbouring buffers of the same pool; the tailroom test in net_buf_simple_add() is only enforced when CONFIG_NET_BUF_HARDENING (or CONFIG_ASSERT) is enabled. On the ISO paths the same unchecked length makes isoal_rx_append_to_sdu() read past the ISO node buffer and emit adjacent controller RAM to the host as ISO data. The practical result is remote memory corruption and controller crashes, plus disclosure of controller memory into the host data path. The fix rejects any received PDU whose length exceeds the value that was used to configure the radio reception. Note that lll_sync.c (periodic advertising sync reception) was not changed and still enqueues received PDUs without an equivalent bound. |
| CVE-2026-95726 | High | 2026-11-03 | Not applicable | No public exploit | A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client. |
| CVE-2026-76955 | High | 2026-11-03 | Not applicable | No public exploit | A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device. |
| CVE-2026-121603 | High | 2026-11-03 | Not applicable | No public exploit | Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution. |
| CVE-2026-109161 | Medium | 2026-11-03 | Not applicable | No public exploit | Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service. |
| CVE-2026-120057 | High | 2026-11-02 | Not applicable | No public exploit | psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected. |
| CVE-2026-106804 | High | 2026-11-02 | Not applicable | Proof of concept only | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service. |
| CVE-2026-120241 | High | 2026-11-01 | Not applicable | Proof of concept only | A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-120226 | Low | 2026-11-01 | Not applicable | Proof of concept only | A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-119146 | Medium | 2026-10-30 | Not applicable | No public exploit | ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session. |
| CVE-2026-93857 | Critical | 2026-10-27 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. |
| CVE-2026-57191 | High | 2026-10-27 | Not applicable | No public exploit | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. |
| CVE-2026-86991 | High | 2026-10-26 | Not applicable | No public exploit | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected process termination. |
| CVE-2026-86972 | High | 2026-10-26 | Not applicable | No public exploit | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted audio file may lead to memory corruption. |
| CVE-2026-82945 | Medium | 2026-10-26 | Not applicable | No public exploit | SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations. |
| CVE-2026-82944 | High | 2026-10-26 | Not applicable | No public exploit | SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution. |
| CVE-2026-112526 | Critical | 2026-10-26 | Not applicable | No public exploit | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination. |
| CVE-2026-112521 | Critical | 2026-10-26 | Not applicable | No public exploit | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions. |
| CVE-2026-112488 | Medium | 2026-10-26 | Not applicable | No public exploit | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may corrupt process memory. |
| CVE-2026-97631 | Critical | 2026-10-22 | Not applicable | No public exploit | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability. |
| CVE-2026-79883 | High | 2026-10-22 | Not applicable | No public exploit | A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service. |
| CVE-2026-79863 | Critical | 2026-10-22 | Not applicable | No public exploit | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. |
| CVE-2026-79862 | Critical | 2026-10-22 | Not applicable | No public exploit | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. |
| CVE-2026-79860 | Critical | 2026-10-22 | Not applicable | No public exploit | Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. |
| CVE-2026-79859 | Critical | 2026-10-22 | Not applicable | No public exploit | Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. |
| CVE-2026-114268 | High | 2026-10-21 | Not applicable | Proof of concept only | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. |
| CVE-2026-43837 | High | 2026-10-20 | Not applicable | No public exploit | A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. |
| CVE-2026-101103 | Medium | 2026-10-20 | Not applicable | No public exploit | The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. |
| CVE-2026-11829 | Medium | 2026-10-19 | Not applicable | No public exploit | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. |
| CVE-2026-11828 | Medium | 2026-10-19 | Not applicable | No public exploit | IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values. |
| CVE-2026-112108 | Low | 2026-10-19 | Not applicable | Proof of concept only | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-112107 | Low | 2026-10-19 | Not applicable | Proof of concept only | A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-26846 | Critical | 2026-10-16 | Not applicable | No public exploit | Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component |
| CVE-2026-102693 | Critical | 2026-10-16 | Not applicable | No public exploit | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04. |
| CVE-2026-0993 | High | 2026-10-15 | Not applicable | Proof of concept only | SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle. |
| CVE-2025-29897 | Low | 2026-10-15 | Not applicable | No public exploit | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later |
| CVE-2026-110695 | Low | 2026-10-14 | Not applicable | Proof of concept only | A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-102176 | High | 2026-10-14 | Not applicable | No public exploit | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. |
| CVE-2016-15060 | Medium | 2026-10-14 | Not applicable | Proof of concept only | A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. |
| CVE-2026-95124 | High | 2026-10-13 | Not applicable | Proof of concept only | Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache() |
| CVE-2026-53420 | High | 2026-10-13 | Not applicable | No public exploit | Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. |
| CVE-2026-108954 | Low | 2026-10-13 | Not applicable | Proof of concept only | A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack. |
| CVE-2025-58772 | High | 2026-10-13 | Not applicable | No public exploit | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability. |
| CVE-2026-108915 | High | 2026-10-12 | Not applicable | Proof of concept only | A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-108914 | High | 2026-10-12 | Not applicable | Proof of concept only | A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-108822 | Medium | 2026-10-12 | Not applicable | No public exploit | A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised. |
| CVE-2026-19570 | High | 2026-10-09 | Not applicable | No public exploit | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets. The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed. A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant. The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass. |
| CVE-2026-15340 | Critical | 2026-10-09 | Not applicable | No public exploit | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. |
| CVE-2026-94587 | Medium | 2026-10-08 | Not applicable | No public exploit | A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon. |
| CVE-2026-94582 | Medium | 2026-10-08 | Not applicable | No public exploit | A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon. |
| CVE-2026-84246 | Critical | 2026-10-08 | Not applicable | No public exploit | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-84198 | Critical | 2026-10-08 | Not applicable | No public exploit | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-82895 | Critical | 2026-10-08 | Not applicable | No public exploit | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
| CVE-2026-79808 | High | 2026-10-06 | Not applicable | No public exploit | A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrupt the availability of the affected service. |
| CVE-2026-76747 | Critical | 2026-10-06 | Not applicable | No public exploit | Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device. |
| CVE-2026-76746 | Critical | 2026-10-06 | Not applicable | No public exploit | An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device. |
| CVE-2026-76744 | Critical | 2026-10-06 | Not applicable | No public exploit | Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code. |
| CVE-2026-81433 | High | 2026-09-30 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet. |
| CVE-2026-103227 | Medium | 2026-09-30 | Not applicable | Proof of concept only | A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component. |
| CVE-2026-76723 | Critical | 2026-09-29 | Not applicable | No public exploit | Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. |
| CVE-2026-102296 | High | 2026-09-28 | Not applicable | Proof of concept only | ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory. |
| CVE-2026-88775 | High | 2026-09-27 | Not applicable | No public exploit | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service |
| CVE-2026-6730 | Critical | 2026-09-23 | Not applicable | No public exploit | IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. |
| CVE-2026-94101 | High | 2026-09-21 | Not applicable | Proof of concept only | A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-94100 | High | 2026-09-21 | Not applicable | Proof of concept only | A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-88409 | High | 2026-09-21 | Not applicable | No public exploit | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2026-93741 | Critical | 2026-09-19 | Not applicable | Proof of concept only | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-93740 | Critical | 2026-09-18 | Not applicable | Proof of concept only | A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. |