Overview 4,208 matches · 18 in Waratek scope · 1 protected · 41 exploited · 20 CISA KEV · 116 public PoC · 24 EPSS ≥ 0.5
4,208matches
18in Waratek scope0.4%
1protected0.0%
41exploited1.0%
20CISA KEV0.5%
116public PoC2.8%
24EPSS ≥ 0.50.6%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.0%
No exploit published
16
0.4%
Outside Waratek scope
13
0.3%
Not applicable
4,177
99.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
4,207
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,519 / year
20092
Not applicable2
High2
not blocked2
Exploited2
20101
Not applicable1
High1
not blocked1
No public exploit1
20110
20120
20130
201416
Not applicable16
High14
Medium2
not blocked16
Exploited2
Working exploit published5
No public exploit9
20153
Not applicable3
Critical1
High2
not blocked3
No public exploit3
20160
201718
Not applicable18
Critical8
High6
Medium4
not blocked18
Working exploit published3
Proof of concept only1
No public exploit14
201860
Not applicable60
Critical27
High28
Medium5
not blocked60
Exploited2
Working exploit published2
Forecast only2
No public exploit54
201951
Outside Waratek scope2
Not applicable49
Critical20
High28
Medium2
Low1
not blocked51
Working exploit published2
Proof of concept only1
Forecast only1
No public exploit47
202059
Not applicable59
Critical18
High39
Medium2
not blocked59
Exploited1
Working exploit published3
Forecast only1
No public exploit54
2021197
Outside Waratek scope2
Not applicable195
Critical29
High162
Medium6
not blocked197
Exploited3
Proof of concept only2
No public exploit192
2022169
Protected by Waratek1
No exploit published10
Outside Waratek scope3
Not applicable155
Critical55
High94
Medium20
blocked by ARMR today1
not blocked168
Exploited8
Working exploit published2
Proof of concept only30
Forecast only2
No public exploit127
2023333
Mitigation candidate1
Not applicable332
Critical155
High154
Medium24
not blocked333
Exploited8
Proof of concept only119
No public exploit206
2024898
No exploit published1
Outside Waratek scope3
Not applicable894
Critical151
High609
Medium135
Low3
not blocked898
Exploited1
Working exploit published1
Proof of concept only407
No public exploit489
2025882
No exploit published4
Outside Waratek scope1
Not applicable877
Critical133
High563
Medium168
Low18
not blocked882
Exploited10
Working exploit published62
Proof of concept only502
No public exploit308
20261,519
No exploit published1
Outside Waratek scope2
Not applicable1,516
Critical227
High1,021
Medium217
Low53
Unknown1
not blocked1,519
Exploited4
Working exploit published3
Proof of concept only603
No public exploit909
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-17518 | High | 2026-10-20 | Not applicable | No public exploit | Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. |
| CVE-2026-112373 | Medium | 2026-10-20 | Not applicable | Proof of concept only | A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. |
| CVE-2026-10139 | Critical | 2026-10-20 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. |
| CVE-2026-10137 | Critical | 2026-10-20 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. |
| CVE-2026-10133 | Critical | 2026-10-20 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. |
| CVE-2026-10132 | Critical | 2026-10-20 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. |
| CVE-2026-12665 | Critical | 2026-10-19 | Not applicable | No public exploit | IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. |
| CVE-2026-112281 | Medium | 2026-10-19 | Not applicable | Proof of concept only | libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address. |
| CVE-2026-112257 | High | 2026-10-19 | Not applicable | No public exploit | A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file. |
| CVE-2026-108984 | High | 2026-10-19 | Not applicable | No public exploit | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
| CVE-2026-105810 | High | 2026-10-19 | Not applicable | No public exploit | Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability. |
| CVE-2026-112063 | Medium | 2026-10-18 | Not applicable | Proof of concept only | libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds. |
| CVE-2026-112062 | Medium | 2026-10-18 | Not applicable | Proof of concept only | lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device. |
| CVE-2026-111711 | Critical | 2026-10-16 | Not applicable | No public exploit | Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code. |
| CVE-2026-102693 | Critical | 2026-10-16 | Not applicable | No public exploit | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04. |
| CVE-2026-79840 | High | 2026-10-15 | Not applicable | No public exploit | A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash. |
| CVE-2026-79839 | High | 2026-10-15 | Not applicable | No public exploit | A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash. |
| CVE-2026-79838 | High | 2026-10-15 | Not applicable | No public exploit | A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash. |
| CVE-2026-79832 | High | 2026-10-15 | Not applicable | No public exploit | A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash. |
| CVE-2026-79830 | Medium | 2026-10-15 | Not applicable | No public exploit | A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution. |
| CVE-2026-79823 | Medium | 2026-10-15 | Not applicable | No public exploit | HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior. |
| CVE-2026-76663 | High | 2026-10-15 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. |
| CVE-2026-76662 | Medium | 2026-10-15 | Not applicable | No public exploit | A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS. |
| CVE-2026-73799 | High | 2026-10-15 | Not applicable | No public exploit | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption |
| CVE-2026-52167 | Medium | 2026-10-15 | Not applicable | No public exploit | A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file. |
| CVE-2026-108445 | High | 2026-10-15 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-108440 | High | 2026-10-15 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-108431 | High | 2026-10-15 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2025-29897 | Low | 2026-10-15 | Not applicable | No public exploit | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later |
| CVE-2026-76655 | High | 2026-10-14 | Not applicable | No public exploit | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution |
| CVE-2026-73795 | Medium | 2026-10-14 | Not applicable | No public exploit | A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service. |
| CVE-2026-33798 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. |
| CVE-2026-33796 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. |
| CVE-2026-33792 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel. |
| CVE-2026-33789 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. |
| CVE-2026-102182 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9; |
| CVE-2026-102180 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO. |
| CVE-2026-102178 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. |
| CVE-2026-102174 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path. |
| CVE-2026-102069 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology. |
| CVE-2026-102068 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP. |
| CVE-2026-102061 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. This issue only affects platforms that support Secure-ZTP. |
| CVE-2026-102057 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services. |
| CVE-2026-102055 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled. |
| CVE-2026-102052 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. |
| CVE-2026-102050 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device. |
| CVE-2026-102049 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. |
| CVE-2026-102014 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. |
| CVE-2026-101990 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement. |
| CVE-2026-101983 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. |
| CVE-2026-101982 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. |
| CVE-2026-101981 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. |
| CVE-2026-101979 | High | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled. |
| CVE-2026-101955 | Critical | 2026-10-14 | Not applicable | No public exploit | A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled. |
| CVE-2026-101341 | High | 2026-10-14 | Not applicable | No public exploit | Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system). |
| CVE-2026-101339 | High | 2026-10-14 | Not applicable | No public exploit | A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system). |
| CVE-2026-101338 | High | 2026-10-14 | Not applicable | No public exploit | When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system). |
| CVE-2026-101337 | High | 2026-10-14 | Not applicable | No public exploit | When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system). |
| CVE-2026-97770 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97761 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97750 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97742 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97333 | High | 2026-10-13 | Not applicable | No public exploit | QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server. |
| CVE-2026-97012 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96995 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96956 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-96248 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network. |
| CVE-2026-88166 | High | 2026-10-13 | Not applicable | No public exploit | Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| CVE-2026-88156 | Critical | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88083 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-87711 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85881 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-85806 | Critical | 2026-10-13 | Not applicable | No public exploit | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85796 | High | 2026-10-13 | Not applicable | No public exploit | Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83965 | High | 2026-10-13 | Not applicable | No public exploit | Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-83934 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83891 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83860 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. |
| CVE-2026-83857 | High | 2026-10-13 | Not applicable | No public exploit | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83767 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83708 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83699 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83643 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70571 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70116 | Medium | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a physical attack. |
| CVE-2026-70110 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-70069 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. |
| CVE-2026-70024 | Critical | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. |
| CVE-2026-65148 | High | 2026-10-13 | Not applicable | No public exploit | NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service. |
| CVE-2026-109940 | Medium | 2026-10-13 | Not applicable | Proof of concept only | FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash. |
| CVE-2026-109833 | Medium | 2026-10-13 | Not applicable | No public exploit | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service. |
| CVE-2026-109157 | High | 2026-10-13 | Not applicable | Proof of concept only | A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-109109 | Critical | 2026-10-13 | Not applicable | No public exploit | A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure. |
| CVE-2026-105732 | High | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. |
| CVE-2026-103854 | High | 2026-10-13 | Not applicable | No public exploit | Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-103851 | High | 2026-10-13 | Not applicable | No public exploit | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-103830 | High | 2026-10-13 | Not applicable | No public exploit | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-103827 | Medium | 2026-10-13 | Not applicable | No public exploit | Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-103823 | Medium | 2026-10-13 | Not applicable | No public exploit | Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-102199 | Medium | 2026-10-13 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network. |