Overview 2,722 matches · 9 in Waratek scope · 0 protected · 17 exploited · 9 CISA KEV · 68 public PoC · 11 EPSS ≥ 0.5
2,722matches
9in Waratek scope0.3%
0protected0.0%
17exploited0.6%
9CISA KEV0.3%
68public PoC2.5%
11EPSS ≥ 0.50.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.0%
No exploit published
8
0.3%
Outside Waratek scope
7
0.3%
Not applicable
2,706
99.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
2,722
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,020 / year
20092
Not applicable2
High2
not blocked2
Exploited2
20101
Not applicable1
High1
not blocked1
No public exploit1
20110
20120
20130
201414
Not applicable14
High14
not blocked14
Exploited2
Working exploit published5
No public exploit7
20152
Not applicable2
High2
not blocked2
No public exploit2
20160
20176
Not applicable6
High6
not blocked6
Working exploit published1
Proof of concept only1
No public exploit4
201828
Not applicable28
High28
not blocked28
Exploited1
Forecast only1
No public exploit26
201928
Outside Waratek scope1
Not applicable27
High28
not blocked28
Working exploit published2
Proof of concept only1
No public exploit25
202039
Not applicable39
High39
not blocked39
Exploited1
Working exploit published2
Forecast only1
No public exploit35
2021162
Outside Waratek scope1
Not applicable161
High162
not blocked162
Exploited1
Proof of concept only1
No public exploit160
202294
No exploit published4
Outside Waratek scope3
Not applicable87
High94
not blocked94
Proof of concept only16
Forecast only1
No public exploit77
2023154
Mitigation candidate1
Not applicable153
High154
not blocked154
Exploited2
Proof of concept only57
No public exploit95
2024609
Not applicable609
High609
not blocked609
Exploited1
Working exploit published1
Proof of concept only262
No public exploit345
2025563
No exploit published3
Outside Waratek scope1
Not applicable559
High563
not blocked563
Exploited5
Working exploit published38
Proof of concept only367
No public exploit153
20261,020
No exploit published1
Outside Waratek scope1
Not applicable1,018
High1,020
not blocked1,020
Exploited2
Working exploit published1
Proof of concept only455
No public exploit562
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-75493 | High | 2026-11-13 | Not applicable | No public exploit | Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service. |
| CVE-2026-75492 | High | 2026-11-13 | Not applicable | No public exploit | Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service. |
| CVE-2026-75488 | High | 2026-11-13 | Not applicable | No public exploit | Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process. |
| CVE-2026-109093 | High | 2026-11-13 | Not applicable | No public exploit | A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server. |
| CVE-2026-47711 | High | 2026-11-12 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. |
| CVE-2026-47710 | High | 2026-11-12 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced property is OBJECT_STRUCTURED_VIEW / PROP_DESCRIPTION containing a long attacker-controlled string. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. |
| CVE-2026-47259 | High | 2026-11-12 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. |
| CVE-2026-47258 | High | 2026-11-12 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. |
| CVE-2026-46674 | High | 2026-11-12 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1. |
| CVE-2026-45265 | High | 2026-11-12 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1. |
| CVE-2026-121744 | High | 2026-11-12 | Not applicable | No public exploit | Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28172. |
| CVE-2026-114563 | High | 2026-11-12 | Not applicable | No public exploit | OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737. |
| CVE-2026-126258 | High | 2026-11-11 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests. |
| CVE-2026-126239 | High | 2026-11-11 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests |
| CVE-2026-126223 | High | 2026-11-11 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests. |
| CVE-2026-96152 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96066 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95948 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-94531 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally. |
| CVE-2026-91754 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01. |
| CVE-2026-67375 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-35500 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts. |
| CVE-2026-123385 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-123381 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-123375 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-122166 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119948 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network. |
| CVE-2026-119849 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |
| CVE-2026-119393 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Credential Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118731 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118720 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118717 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118711 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118704 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118700 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118295 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118292 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118283 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118226 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118141 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-116936 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-114152 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-114151 | High | 2026-11-10 | Not applicable | No public exploit | Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-113748 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-113512 | High | 2026-11-10 | Not applicable | No public exploit | After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-112811 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112799 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
| CVE-2026-111287 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-109800 | High | 2026-11-10 | Not applicable | No public exploit | SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application. |
| CVE-2026-109793 | High | 2026-11-10 | Not applicable | No public exploit | SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity. |
| CVE-2026-109505 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-109475 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-107245 | High | 2026-11-10 | Not applicable | No public exploit | Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. What is impacted? VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. What is not impacted? The VOS nodes listed above are not vulnerable if they are not accessible from the Internet. |
| CVE-2026-105581 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105553 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105493 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105490 | High | 2026-11-10 | Not applicable | No public exploit | Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-124561 | High | 2026-11-09 | Not applicable | Proof of concept only | A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-17401 | High | 2026-11-07 | Not applicable | No public exploit | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. |
| CVE-2026-94395 | High | 2026-11-05 | Not applicable | No public exploit | A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449). |
| CVE-2026-123202 | High | 2026-11-05 | Not applicable | No public exploit | libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications. |
| CVE-2026-123151 | High | 2026-11-05 | Not applicable | No public exploit | A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB. |
| CVE-2026-122329 | High | 2026-11-05 | Not applicable | No public exploit | SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution. |
| CVE-2026-122328 | High | 2026-11-05 | Not applicable | Proof of concept only | SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution. |
| CVE-2026-121995 | High | 2026-11-05 | Not applicable | No public exploit | A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer. |
| CVE-2026-121994 | High | 2026-11-05 | Not applicable | No public exploit | A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width. |
| CVE-2026-116570 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration. The overflow can corrupt the stack and crash FreeSWITCH, ending every active call, although the overrun bytes come from the configured credential and remote code execution has not been demonstrated. This issue is fixed in version 1.11.2. |
| CVE-2026-116567 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2. |
| CVE-2026-115928 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and salt length from an inbound SDP a=crypto attribute to switch_b64_decode() as the destination capacity. A zero-length key and salt made that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call was answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser, while profiles that challenge inbound calls remain affected for senders who can authenticate; setting rtp_secure_media_inbound to false removes the path, and WebRTC DTLS-SRTP legs are unaffected. The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2. |
| CVE-2026-90628 | High | 2026-11-04 | Not applicable | No public exploit | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-84730 | High | 2026-11-04 | Not applicable | No public exploit | Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information. |
| CVE-2026-121969 | High | 2026-11-04 | Not applicable | No public exploit | netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client. |
| CVE-2026-121600 | High | 2026-11-04 | Not applicable | Proof of concept only | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. |
| CVE-2026-121599 | High | 2026-11-04 | Not applicable | Proof of concept only | A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. |
| CVE-2026-121598 | High | 2026-11-04 | Not applicable | Proof of concept only | A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. |
| CVE-2026-121597 | High | 2026-11-04 | Not applicable | Proof of concept only | A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-113783 | High | 2026-11-04 | Not applicable | No public exploit | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line. |
| CVE-2026-113782 | High | 2026-11-04 | Not applicable | No public exploit | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5. |
| CVE-2026-58966 | High | 2026-11-02 | Not applicable | No public exploit | In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58949 | High | 2026-11-02 | Not applicable | No public exploit | In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-29508 | High | 2026-11-02 | Not applicable | Proof of concept only | ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections. |
| CVE-2026-120752 | High | 2026-11-02 | Not applicable | Proof of concept only | PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code. |
| CVE-2026-120434 | High | 2026-11-02 | Not applicable | No public exploit | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code. |
| CVE-2026-120433 | High | 2026-11-02 | Not applicable | No public exploit | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution. |
| CVE-2026-120061 | High | 2026-11-02 | Not applicable | No public exploit | The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected. |
| CVE-2026-106808 | High | 2026-11-02 | Not applicable | Proof of concept only | OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process. |
| CVE-2026-106804 | High | 2026-11-02 | Not applicable | Proof of concept only | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service. |
| CVE-2026-78402 | High | 2026-10-30 | Not applicable | No public exploit | Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling local privilege escalation. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0. |
| CVE-2026-65584 | High | 2026-10-30 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash. The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer. |
| CVE-2026-119528 | High | 2026-10-30 | Not applicable | No public exploit | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. |
| CVE-2026-119086 | High | 2026-10-30 | Not applicable | No public exploit | Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary. To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected. |
| CVE-2026-86378 | High | 2026-10-28 | Not applicable | No public exploit | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. |
| CVE-2026-118610 | High | 2026-10-28 | Not applicable | No public exploit | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015. |
| CVE-2026-118605 | High | 2026-10-28 | Not applicable | No public exploit | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the prh_sdp_service_search_decode function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29069. |
| CVE-2026-118603 | High | 2026-10-28 | Not applicable | No public exploit | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017. |
| CVE-2026-117609 | High | 2026-10-28 | Not applicable | No public exploit | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries. |
| CVE-2026-103408 | High | 2026-10-28 | Not applicable | No public exploit | A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply. |
| CVE-2026-90442 | High | 2026-10-27 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request. |
| CVE-2026-48379 | High | 2026-10-27 | Not applicable | No public exploit | Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-103593 | High | 2026-10-27 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. |