WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-125✕
Overview 10,813 matches · 35 in Waratek scope · 2 protected · 34 exploited · 19 CISA KEV · 100 public PoC · 28 EPSS ≥ 0.5
10,813matches 35in Waratek scope0.3% 2protected0.0% 34exploited0.3% 19CISA KEV0.2% 100public PoC0.9% 28EPSS ≥ 0.50.3%
Protected by Waratek 2 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 33 0.3% Outside Waratek scope 58 0.5% Not applicable 10,718 99.1% Withdrawn CVE 2 0.0%
Critical 865 8.0% High 4,637 42.9% Medium 4,830 44.7% Low 477 4.4% None 0 0.0% Unknown 4 0.0%
blocked by ARMR today 2 0.0% partly blocked 0 0.0% not blocked 10,811 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 34 0.3% Working exploit published 68 0.6% Proof of concept only 720 6.7% Forecast only 14 0.1% No public exploit 9,977 92.3%
split by peak 2,776 / year
Withdrawn CVE: 2Not applicable: 10,718Outside Waratek scope: 58No exploit published: 33Protected by Waratek: 2 Unknown: 4Low: 477Medium: 4,830High: 4,637Critical: 865 not blocked: 10,811blocked by ARMR today: 2 No public exploit: 9,977Forecast only: 14Proof of concept only: 720Working exploit published: 68Exploited: 34
19961 Not applicable1 High1 not blocked1 No public exploit1 19971 Not applicable1 High1 not blocked1 Working exploit published1 19981 Not applicable1 Critical1 not blocked1 Working exploit published1 19990 20000 20010 20020 20030 20046 Not applicable6 Medium6 not blocked6 Working exploit published2 No public exploit4 20050 20062 Not applicable2 Medium2 not blocked2 No public exploit2 20071 Not applicable1 Medium1 not blocked1 No public exploit1 20080 20091 Not applicable1 High1 not blocked1 No public exploit1 20101 Not applicable1 High1 not blocked1 No public exploit1 201126 Not applicable26 High1 Medium25 not blocked26 No public exploit26 201217 Not applicable17 High1 Medium16 not blocked17 No public exploit17 20135 Not applicable5 High3 Medium2 not blocked5 Proof of concept only1 No public exploit4 201410 Not applicable10 Critical1 High5 Medium4 not blocked10 Exploited1 No public exploit9 20154 Not applicable4 High2 Medium2 not blocked4 No public exploit4 201690 Not applicable90 Critical8 High45 Medium36 Low1 not blocked90 Exploited2 Working exploit published3 No public exploit85 2017711 Outside Waratek scope4 Not applicable706 Withdrawn CVE1 Critical139 High269 Medium296 Low6 Unknown1 not blocked711 Exploited2 Working exploit published21 Proof of concept only1 Forecast only2 No public exploit685 2018768 Outside Waratek scope6 Not applicable762 Critical74 High303 Medium388 Low3 not blocked768 Exploited3 Working exploit published15 Proof of concept only2 Forecast only1 No public exploit747 2019908 No exploit published1 Outside Waratek scope17 Not applicable889 Withdrawn CVE1 Critical115 High400 Medium381 Low11 Unknown1 not blocked908 Exploited4 Working exploit published16 Proof of concept only5 No public exploit883 2020673 Outside Waratek scope14 Not applicable659 Critical91 High250 Medium294 Low38 not blocked673 Exploited1 Working exploit published2 Proof of concept only1 Forecast only3 No public exploit666 2021730 No exploit published2 Outside Waratek scope7 Not applicable721 Critical72 High320 Medium261 Low77 not blocked730 Exploited1 Working exploit published1 Proof of concept only4 Forecast only2 No public exploit722 2022864 No exploit published2 Outside Waratek scope5 Not applicable857 Critical69 High401 Medium340 Low54 not blocked864 Exploited3 Proof of concept only92 Forecast only1 No public exploit768 2023988 No exploit published3 Outside Waratek scope1 Not applicable984 Critical45 High380 Medium547 Low16 not blocked988 Exploited5 Working exploit published3 Proof of concept only72 Forecast only3 No public exploit905 20241,231 No exploit published9 Outside Waratek scope2 Not applicable1,220 Critical57 High590 Medium533 Low51 not blocked1,231 Exploited2 Working exploit published1 Proof of concept only73 Forecast only1 No public exploit1,154 2025998 No exploit published7 Outside Waratek scope2 Not applicable989 Critical43 High529 Medium370 Low56 not blocked998 Exploited5 Working exploit published2 Proof of concept only59 Forecast only1 No public exploit931 20262,776 Protected by Waratek2 No exploit published9 Not applicable2,765 Critical150 High1,134 Medium1,326 Low164 Unknown2 blocked by ARMR today2 not blocked2,774 Exploited5 Proof of concept only410 No public exploit2,361
19961999200220052008201120142017202020232026
10,813 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 109 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-119999 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-119971 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-119970 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-119940 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
CVE-2026-119925 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
CVE-2026-119900 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-119890 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network.
CVE-2026-119889 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network.
CVE-2026-119862 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Input System allows an authorized attacker to elevate privileges locally.
CVE-2026-119846 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVE-2026-119838 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.
CVE-2026-119395 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Storport.sys Driver allows an authorized attacker to disclose information with a physical attack.
CVE-2026-118728 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-118727 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-118725 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-118300 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-118293 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118278 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-118232 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-118200 Medium 2026-11-10 Not applicable No public exploit Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-118199 Medium 2026-11-10 Not applicable No public exploit Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-118143 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-118142 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-118124 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
CVE-2026-118103 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-116940 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-116939 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-116932 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-115345 Medium 2026-11-10 Not applicable No public exploit Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113758 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-113519 Medium 2026-11-10 Not applicable No public exploit After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113514 Medium 2026-11-10 Not applicable No public exploit After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-11315 Medium 2026-11-10 Not applicable No public exploit A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2026-112965 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
CVE-2026-112814 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-112755 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows RNDIS allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-112754 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
CVE-2026-112738 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-112720 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-111298 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-111292 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-111291 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
CVE-2026-111288 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-110093 Low 2026-11-10 Not applicable No public exploit After Effects is affected by an out-of-bounds read vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-110066 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-109806 High 2026-11-10 Not applicable No public exploit SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
CVE-2026-109501 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108425 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.
CVE-2026-108424 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
CVE-2026-108423 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally.
CVE-2026-108421 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-108419 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-108418 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-108417 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-108408 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.
CVE-2026-108407 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.
CVE-2026-105579 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
CVE-2026-105569 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-105568 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
CVE-2026-105552 Medium 2026-11-10 Not applicable No public exploit An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.
CVE-2026-105549 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Smart Card allows an authorized attacker to disclose information with a physical attack.
CVE-2026-105499 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-105498 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-105492 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
CVE-2026-105028 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-0195 Medium 2026-11-10 Not applicable No public exploit In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-90588 Low 2026-11-09 Not applicable No public exploit The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte. The slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET. The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region. The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it).
CVE-2026-125270 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.
CVE-2026-125261 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.
CVE-2026-125228 Medium 2026-11-09 Not applicable No public exploit FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.
CVE-2026-125211 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.
CVE-2026-125194 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.
CVE-2026-125193 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory.
CVE-2026-125182 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR.
CVE-2026-125178 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.
CVE-2026-125172 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.
CVE-2026-125171 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.
CVE-2026-124996 Medium 2026-11-09 Not applicable Proof of concept only A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended.
CVE-2026-124994 Low 2026-11-09 Not applicable Proof of concept only A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.
CVE-2026-124586 Medium 2026-11-09 Not applicable Proof of concept only A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-123805 High 2026-11-09 Not applicable No public exploit SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.
CVE-2026-121601 Medium 2026-11-09 Not applicable No public exploit A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
CVE-2026-119610 High 2026-11-09 Not applicable No public exploit A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.
CVE-2026-124312 Medium 2026-11-07 Not applicable Proof of concept only Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.
CVE-2026-124309 Medium 2026-11-07 Not applicable No public exploit Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.
CVE-2026-73471 Medium 2026-11-06 Not applicable No public exploit A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVE-2026-123269 Low 2026-11-06 Not applicable Proof of concept only A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
CVE-2026-119924 High 2026-11-06 Not applicable No public exploit An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
CVE-2026-104254 Medium 2026-11-06 Not applicable No public exploit liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0.
CVE-2026-92698 High 2026-11-05 Not applicable No public exploit FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.
CVE-2026-92697 High 2026-11-05 Not applicable Proof of concept only FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls  strlen()  on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.
CVE-2026-92695 High 2026-11-05 Not applicable Proof of concept only FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.
CVE-2026-92693 High 2026-11-05 Not applicable Proof of concept only FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.
CVE-2026-76077 High 2026-11-05 Not applicable No public exploit ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.
CVE-2026-75615 Medium 2026-11-05 Not applicable Proof of concept only ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.
CVE-2026-70660 Medium 2026-11-05 Not applicable Proof of concept only stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_offsets after checking only that nbytes equals end - begin. A crafted .safetensors file can declare a byte range beyond the file's data section, causing src/model_loader.cpp to consume an attacker-chosen length from an unchecked mapped-file offset. Loading the model can read adjacent process memory into tensor buffers or crash the process. This issue is fixed in master-764-e22272e.
CVE-2026-122189 Low 2026-11-05 Not applicable Proof of concept only A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116784 High 2026-11-05 Not applicable No public exploit FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.
CVE-2026-116782 High 2026-11-05 Not applicable No public exploit FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
CVE-2026-116780 Low 2026-11-05 Not applicable No public exploit FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
‹ prev page 2 of 109 next ›