WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-125✕
Overview 10,807 matches · 35 in Waratek scope · 2 protected · 34 exploited · 19 CISA KEV · 100 public PoC · 28 EPSS ≥ 0.5
10,807matches 35in Waratek scope0.3% 2protected0.0% 34exploited0.3% 19CISA KEV0.2% 100public PoC0.9% 28EPSS ≥ 0.50.3%
Protected by Waratek 2 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 33 0.3% Outside Waratek scope 58 0.5% Not applicable 10,712 99.1% Withdrawn CVE 2 0.0%
Critical 865 8.0% High 4,635 42.9% Medium 4,829 44.7% Low 474 4.4% None 0 0.0% Unknown 4 0.0%
blocked by ARMR today 2 0.0% partly blocked 0 0.0% not blocked 10,805 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 34 0.3% Working exploit published 68 0.6% Proof of concept only 720 6.7% Forecast only 14 0.1% No public exploit 9,971 92.3%
split by peak 2,770 / year
Withdrawn CVE: 2Not applicable: 10,712Outside Waratek scope: 58No exploit published: 33Protected by Waratek: 2 Unknown: 4Low: 474Medium: 4,829High: 4,635Critical: 865 not blocked: 10,805blocked by ARMR today: 2 No public exploit: 9,971Forecast only: 14Proof of concept only: 720Working exploit published: 68Exploited: 34
19961 Not applicable1 High1 not blocked1 No public exploit1 19971 Not applicable1 High1 not blocked1 Working exploit published1 19981 Not applicable1 Critical1 not blocked1 Working exploit published1 19990 20000 20010 20020 20030 20046 Not applicable6 Medium6 not blocked6 Working exploit published2 No public exploit4 20050 20062 Not applicable2 Medium2 not blocked2 No public exploit2 20071 Not applicable1 Medium1 not blocked1 No public exploit1 20080 20091 Not applicable1 High1 not blocked1 No public exploit1 20101 Not applicable1 High1 not blocked1 No public exploit1 201126 Not applicable26 High1 Medium25 not blocked26 No public exploit26 201217 Not applicable17 High1 Medium16 not blocked17 No public exploit17 20135 Not applicable5 High3 Medium2 not blocked5 Proof of concept only1 No public exploit4 201410 Not applicable10 Critical1 High5 Medium4 not blocked10 Exploited1 No public exploit9 20154 Not applicable4 High2 Medium2 not blocked4 No public exploit4 201690 Not applicable90 Critical8 High45 Medium36 Low1 not blocked90 Exploited2 Working exploit published3 No public exploit85 2017711 Outside Waratek scope4 Not applicable706 Withdrawn CVE1 Critical139 High269 Medium296 Low6 Unknown1 not blocked711 Exploited2 Working exploit published21 Proof of concept only1 Forecast only2 No public exploit685 2018768 Outside Waratek scope6 Not applicable762 Critical74 High303 Medium388 Low3 not blocked768 Exploited3 Working exploit published15 Proof of concept only2 Forecast only1 No public exploit747 2019908 No exploit published1 Outside Waratek scope17 Not applicable889 Withdrawn CVE1 Critical115 High400 Medium381 Low11 Unknown1 not blocked908 Exploited4 Working exploit published16 Proof of concept only5 No public exploit883 2020673 Outside Waratek scope14 Not applicable659 Critical91 High250 Medium294 Low38 not blocked673 Exploited1 Working exploit published2 Proof of concept only1 Forecast only3 No public exploit666 2021730 No exploit published2 Outside Waratek scope7 Not applicable721 Critical72 High320 Medium261 Low77 not blocked730 Exploited1 Working exploit published1 Proof of concept only4 Forecast only2 No public exploit722 2022864 No exploit published2 Outside Waratek scope5 Not applicable857 Critical69 High401 Medium340 Low54 not blocked864 Exploited3 Proof of concept only92 Forecast only1 No public exploit768 2023988 No exploit published3 Outside Waratek scope1 Not applicable984 Critical45 High380 Medium547 Low16 not blocked988 Exploited5 Working exploit published3 Proof of concept only72 Forecast only3 No public exploit905 20241,231 No exploit published9 Outside Waratek scope2 Not applicable1,220 Critical57 High590 Medium533 Low51 not blocked1,231 Exploited2 Working exploit published1 Proof of concept only73 Forecast only1 No public exploit1,154 2025998 No exploit published7 Outside Waratek scope2 Not applicable989 Critical43 High529 Medium370 Low56 not blocked998 Exploited5 Working exploit published2 Proof of concept only59 Forecast only1 No public exploit931 20262,770 Protected by Waratek2 No exploit published9 Not applicable2,759 Critical150 High1,132 Medium1,325 Low161 Unknown2 blocked by ARMR today2 not blocked2,768 Exploited5 Proof of concept only410 No public exploit2,355
19961999200220052008201120142017202020232026
10,807 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 109 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-64675 Medium 2026-11-13 Not applicable Proof of concept only BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62976 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-62975 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-62973 High 2026-11-13 Not applicable Proof of concept only BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62972 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-58265 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-49990 High 2026-11-13 Not applicable Proof of concept only BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
CVE-2026-129217 Medium 2026-11-13 Not applicable No public exploit In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.
CVE-2026-128991 Medium 2026-11-13 Not applicable No public exploit xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash.
CVE-2026-127916 Low 2026-11-13 Not applicable No public exploit bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed. The callers bound part of the span, or none of it: On the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB. The serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well. The image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication. Whether a malformed header produces an actual read beyond the area depends on the flash backend: Backends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read. With MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check. The Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy(). The bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting. The fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller.
CVE-2026-127915 Low 2026-11-13 Not applicable No public exploit The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it. The path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying. The residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator.
CVE-2026-111547 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.
CVE-2026-46677 Medium 2026-11-12 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.
CVE-2026-46674 High 2026-11-12 Not applicable Proof of concept only BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1.
CVE-2026-126957 Medium 2026-11-12 Not applicable No public exploit An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.
CVE-2026-124023 Unknown 2026-11-12 Not applicable No public exploit Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.
CVE-2026-114469 Medium 2026-11-12 Not applicable No public exploit Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size
CVE-2024-21963 Medium 2026-11-12 Not applicable No public exploit An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability.
CVE-2026-64667 Medium 2026-11-11 Not applicable No public exploit pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.
CVE-2026-126922 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126913 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126894 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126890 High 2026-11-11 Not applicable No public exploit Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126884 Medium 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126871 Medium 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126857 Medium 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126841 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126256 High 2026-11-11 Not applicable No public exploit A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets.
CVE-2026-97006 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-97002 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally.
CVE-2026-96989 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally.
CVE-2026-96988 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96987 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96986 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96985 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96984 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96980 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96976 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96975 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
CVE-2026-96972 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.
CVE-2026-96970 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-96160 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96112 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally.
CVE-2026-96093 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally.
CVE-2026-96086 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network.
CVE-2026-96082 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.
CVE-2026-96060 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96058 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack.
CVE-2026-96051 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-96041 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally.
CVE-2026-95999 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-95977 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Event Viewer allows an authorized attacker to disclose information locally.
CVE-2026-95953 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95950 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95946 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
CVE-2026-95942 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95909 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95908 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally.
CVE-2026-95906 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95879 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95692 Unknown 2026-11-10 Not applicable No public exploit Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected. Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV. CWE: CWE-125: Out-of-bounds Read Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length. The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery. Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application. FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm.
CVE-2026-90832 Medium 2026-11-10 Not applicable No public exploit bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload. The Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends. Exploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync. The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers.
CVE-2026-88243 Critical 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88231 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.
CVE-2026-88211 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.
CVE-2026-77685 High 2026-11-10 Not applicable No public exploit The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255. rfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out. The trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect. The resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will. Two fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write.
CVE-2026-66813 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-66333 Medium 2026-11-10 Not applicable No public exploit AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also impact Confidentiality, and Availability.
CVE-2026-66332 Medium 2026-11-10 Not applicable No public exploit AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also potentially impact Confidentiality and Availability.
CVE-2026-59986 High 2026-11-10 Not applicable Proof of concept only rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.
CVE-2026-59628 Medium 2026-11-10 Not applicable No public exploit In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55716 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in the CheckUefiVgaMode for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-50249 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in the GenerationSetup for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-50078 Medium 2026-11-10 Not applicable No public exploit Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.
CVE-2026-44382 High 2026-11-10 Not applicable No public exploit Out-of-bounds read for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-40424 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-40216 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-33571 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-28746 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-14918 Medium 2026-11-10 Not applicable No public exploit The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.
CVE-2026-125712 High 2026-11-10 Not applicable No public exploit A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
CVE-2026-125706 Medium 2026-11-10 Not applicable No public exploit A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
CVE-2026-125405 High 2026-11-10 Not applicable No public exploit Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
CVE-2026-125403 High 2026-11-10 Not applicable No public exploit Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
CVE-2026-125402 High 2026-11-10 Not applicable No public exploit Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.
CVE-2026-125135 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-124179 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-124178 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-123388 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVE-2026-122518 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-122183 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-122162 Medium 2026-11-10 Not applicable No public exploit Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.
CVE-2026-121678 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-121677 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-121292 High 2026-11-10 Not applicable No public exploit A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.
CVE-2026-119999 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-119971 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-119970 Medium 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
CVE-2026-119940 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
CVE-2026-119925 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
‹ prev page 1 of 109 next ›