Overview 488 matches · 3 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
488matches
3in Waratek scope0.6%
0protected0.0%
1exploited0.2%
0CISA KEV0.0%
3public PoC0.6%
2EPSS ≥ 0.50.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
0.6%
Outside Waratek scope
2
0.4%
Not applicable
483
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
488
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 273 / year
20131
Not applicable1
Medium1
not blocked1
Proof of concept only1
20142
Not applicable2
Medium2
not blocked2
No public exploit2
20150
20160
20170
20183
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20190
202010
Not applicable10
Medium10
not blocked10
No public exploit10
202113
Not applicable13
Medium13
not blocked13
Forecast only2
No public exploit11
202211
Not applicable11
Medium11
not blocked11
Proof of concept only1
No public exploit10
202334
No exploit published1
Not applicable33
Medium34
not blocked34
Proof of concept only10
No public exploit24
202470
No exploit published1
Not applicable69
Medium70
not blocked70
Proof of concept only20
No public exploit50
202571
Not applicable71
Medium71
not blocked71
Exploited1
Proof of concept only28
No public exploit42
2026273
No exploit published1
Outside Waratek scope2
Not applicable270
Medium273
not blocked273
Proof of concept only47
No public exploit226
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-123828 | Medium | 2026-11-11 | Not applicable | No public exploit | A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x. |
| CVE-2026-97015 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
| CVE-2026-95905 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-63540 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-59601 | Medium | 2026-11-10 | Not applicable | No public exploit | In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58696 | Medium | 2026-11-10 | Not applicable | No public exploit | In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56956 | Medium | 2026-11-10 | Not applicable | No public exploit | In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-34017 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-122173 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-122167 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119937 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119885 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119884 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119872 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119840 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119830 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119829 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119823 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-119394 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Enhanced Storage allows an authorized attacker to execute code with a physical attack. |
| CVE-2026-118144 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-116700 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-116699 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. |
| CVE-2026-113817 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-113816 | Medium | 2026-11-10 | Not applicable | No public exploit | Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112984 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-112969 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-112807 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a network. |
| CVE-2026-108404 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows CD-ROM Driver allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-105018 | Medium | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-124000 | Medium | 2026-11-09 | Not applicable | No public exploit | NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd. |
| CVE-2026-77709 | Medium | 2026-11-06 | Not applicable | No public exploit | A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service. |
| CVE-2026-62365 | Medium | 2026-11-04 | Not applicable | Proof of concept only | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7. |
| CVE-2026-59267 | Medium | 2026-11-04 | Not applicable | No public exploit | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
| CVE-2026-12550 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters. |
| CVE-2026-65108 | Medium | 2026-11-03 | Not applicable | No public exploit | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions. |
| CVE-2026-58953 | Medium | 2026-11-02 | Not applicable | No public exploit | In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-119727 | Medium | 2026-10-30 | Not applicable | No public exploit | A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact. |
| CVE-2026-110133 | Medium | 2026-10-30 | Not applicable | No public exploit | A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution. |
| CVE-2026-119124 | Medium | 2026-10-29 | Not applicable | No public exploit | ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application. |
| CVE-2026-93536 | Medium | 2026-10-28 | Not applicable | No public exploit | A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code. |
| CVE-2026-86392 | Medium | 2026-10-28 | Not applicable | No public exploit | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
| CVE-2026-118611 | Medium | 2026-10-28 | Not applicable | No public exploit | Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth OBEX packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29012. |
| CVE-2026-118318 | Medium | 2026-10-27 | Not applicable | No public exploit | Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-116124 | Medium | 2026-10-26 | Not applicable | No public exploit | A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue. |
| CVE-2026-116160 | Medium | 2026-10-25 | Not applicable | No public exploit | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application. |
| CVE-2026-102484 | Medium | 2026-10-21 | Not applicable | No public exploit | Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies. |
| CVE-2025-60490 | Medium | 2026-10-21 | Not applicable | Proof of concept only | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. |
| CVE-2026-11831 | Medium | 2026-10-19 | Not applicable | No public exploit | IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. |
| CVE-2026-112280 | Medium | 2026-10-19 | Not applicable | No public exploit | libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory. |
| CVE-2025-60480 | Medium | 2026-10-19 | Not applicable | No public exploit | A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. |
| CVE-2026-111458 | Medium | 2026-10-16 | Not applicable | No public exploit | The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool. |
| CVE-2025-55640 | Medium | 2026-10-16 | Not applicable | Proof of concept only | A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. |
| CVE-2026-79831 | Medium | 2026-10-15 | Not applicable | No public exploit | A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution. |
| CVE-2026-110837 | Medium | 2026-10-14 | Not applicable | Proof of concept only | FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client. |
| CVE-2026-97817 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-97813 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network. |
| CVE-2026-96938 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96863 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-88089 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. |
| CVE-2026-88085 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85831 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally. |
| CVE-2026-83945 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| CVE-2026-83895 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-83736 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70189 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. |
| CVE-2026-69958 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-69947 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. |
| CVE-2026-69635 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-67456 | Medium | 2026-10-13 | Not applicable | No public exploit | NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service. |
| CVE-2026-102206 | Medium | 2026-10-13 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-109256 | Medium | 2026-10-12 | Not applicable | Proof of concept only | FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash. |
| CVE-2026-109255 | Medium | 2026-10-12 | Not applicable | Proof of concept only | FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution. |
| CVE-2026-103658 | Medium | 2026-10-12 | Not applicable | Proof of concept only | GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3. |
| CVE-2026-108978 | Medium | 2026-10-11 | Not applicable | No public exploit | Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9. |
| CVE-2026-96396 | Medium | 2026-10-09 | Not applicable | No public exploit | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash. |
| CVE-2026-95125 | Medium | 2026-10-08 | Not applicable | Proof of concept only | libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service. |
| CVE-2026-107651 | Medium | 2026-10-08 | Not applicable | No public exploit | A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash. |
| CVE-2026-106177 | Medium | 2026-10-08 | Not applicable | No public exploit | A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability. |
| CVE-2026-103011 | Medium | 2026-10-08 | Not applicable | No public exploit | Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct. |
| CVE-2026-106574 | Medium | 2026-10-07 | Not applicable | No public exploit | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31. |
| CVE-2026-106564 | Medium | 2026-10-07 | Not applicable | No public exploit | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32. |
| CVE-2026-105842 | Medium | 2026-10-06 | Not applicable | No public exploit | lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz. |
| CVE-2026-103500 | Medium | 2026-09-30 | Not applicable | No public exploit | An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. |
| CVE-2026-96417 | Medium | 2026-09-29 | Not applicable | No public exploit | RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96416 | Medium | 2026-09-29 | Not applicable | Proof of concept only | IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-95393 | Medium | 2026-09-29 | Not applicable | Proof of concept only | CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-95388 | Medium | 2026-09-29 | Not applicable | Proof of concept only | Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-92842 | Medium | 2026-09-25 | Not applicable | No public exploit | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output. |
| CVE-2026-91767 | Medium | 2026-09-25 | Not applicable | No public exploit | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default. |
| CVE-2025-1218 | Medium | 2026-09-25 | Not applicable | No public exploit | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process. |
| CVE-2026-92905 | Medium | 2026-09-24 | Not applicable | No public exploit | Zoho Corporation ManageEngine EventLog Analyzer and Log360 versions below 13071 are vulnerable to a denial-of-service (DoS) vulnerability in the log collector component. |
| CVE-2026-88386 | Medium | 2026-09-24 | Not applicable | Proof of concept only | libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service. |
| CVE-2026-88370 | Medium | 2026-09-24 | Not applicable | Proof of concept only | libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service. |
| CVE-2026-93962 | Medium | 2026-09-20 | Not applicable | Proof of concept only | A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component. |
| CVE-2026-77396 | Medium | 2026-09-18 | Not applicable | No public exploit | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review. |
| CVE-2026-63451 | Medium | 2026-09-18 | Not applicable | No public exploit | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6. |
| CVE-2026-57226 | Medium | 2026-09-18 | Not applicable | No public exploit | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17. |
| CVE-2026-92399 | Medium | 2026-09-16 | Not applicable | Proof of concept only | A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended. |
| CVE-2026-90439 | Medium | 2026-09-15 | Not applicable | No public exploit | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-86870 | Medium | 2026-09-14 | Not applicable | No public exploit | A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination. |