Overview 4,637 matches · 17 in Waratek scope · 1 protected · 22 exploited · 12 CISA KEV · 49 public PoC · 14 EPSS ≥ 0.5
4,637matches
17in Waratek scope0.4%
1protected0.0%
22exploited0.5%
12CISA KEV0.3%
49public PoC1.1%
14EPSS ≥ 0.50.3%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
16
0.3%
Outside Waratek scope
29
0.6%
Not applicable
4,591
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
4,636
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,134 / year
19961
Not applicable1
High1
not blocked1
No public exploit1
19971
Not applicable1
High1
not blocked1
Working exploit published1
19980
19990
20000
20010
20020
20030
20040
20050
20060
20070
20080
20091
Not applicable1
High1
not blocked1
No public exploit1
20101
Not applicable1
High1
not blocked1
No public exploit1
20111
Not applicable1
High1
not blocked1
No public exploit1
20121
Not applicable1
High1
not blocked1
No public exploit1
20133
Not applicable3
High3
not blocked3
No public exploit3
20145
Not applicable5
High5
not blocked5
Exploited1
No public exploit4
20152
Not applicable2
High2
not blocked2
No public exploit2
201645
Not applicable45
High45
not blocked45
Exploited2
Working exploit published1
No public exploit42
2017269
Outside Waratek scope3
Not applicable266
High269
not blocked269
Exploited2
Working exploit published5
Proof of concept only1
Forecast only1
No public exploit260
2018303
Outside Waratek scope3
Not applicable300
High303
not blocked303
Exploited1
Working exploit published9
Proof of concept only1
Forecast only1
No public exploit291
2019400
No exploit published1
Outside Waratek scope7
Not applicable392
High400
not blocked400
Exploited3
Working exploit published5
Proof of concept only2
No public exploit390
2020250
Outside Waratek scope7
Not applicable243
High250
not blocked250
Working exploit published1
Proof of concept only1
No public exploit248
2021320
No exploit published1
Outside Waratek scope6
Not applicable313
High320
not blocked320
Exploited1
Working exploit published1
Proof of concept only1
Forecast only1
No public exploit316
2022401
No exploit published1
Not applicable400
High401
not blocked401
Exploited2
Proof of concept only66
No public exploit333
2023380
No exploit published2
Not applicable378
High380
not blocked380
Exploited1
Working exploit published2
Proof of concept only33
Forecast only3
No public exploit341
2024590
No exploit published4
Outside Waratek scope1
Not applicable585
High590
not blocked590
Exploited2
Working exploit published1
Proof of concept only29
No public exploit558
2025529
No exploit published1
Outside Waratek scope2
Not applicable526
High529
not blocked529
Exploited3
Working exploit published2
Proof of concept only12
Forecast only1
No public exploit511
20261,134
Protected by Waratek1
No exploit published6
Not applicable1,127
High1,134
blocked by ARMR today1
not blocked1,133
Exploited4
Proof of concept only126
No public exploit1,004
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-129432 | High | 2026-11-14 | Not applicable | No public exploit | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adjacent attackers can send a crafted MOUNT MNT call to read up to 100 bytes past the heap buffer, leaking memory to the console and logs. |
| CVE-2026-129431 | High | 2026-11-14 | Not applicable | No public exploit | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials. |
| CVE-2026-62976 | High | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0. |
| CVE-2026-62973 | High | 2026-11-13 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0. |
| CVE-2026-49990 | High | 2026-11-13 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1. |
| CVE-2026-111547 | High | 2026-11-13 | Not applicable | No public exploit | Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure. |
| CVE-2026-46674 | High | 2026-11-12 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1. |
| CVE-2026-126890 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126256 | High | 2026-11-11 | Not applicable | No public exploit | A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets. |
| CVE-2026-97002 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96972 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-96160 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96060 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96051 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95999 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95953 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95950 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95942 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95909 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95906 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95879 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-77685 | High | 2026-11-10 | Not applicable | No public exploit | The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255. rfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out. The trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect. The resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will. Two fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write. |
| CVE-2026-66813 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-59986 | High | 2026-11-10 | Not applicable | Proof of concept only | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0. |
| CVE-2026-44382 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-125712 | High | 2026-11-10 | Not applicable | No public exploit | A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory. |
| CVE-2026-125405 | High | 2026-11-10 | Not applicable | No public exploit | Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process. |
| CVE-2026-125403 | High | 2026-11-10 | Not applicable | No public exploit | Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root. |
| CVE-2026-125402 | High | 2026-11-10 | Not applicable | No public exploit | Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap. |
| CVE-2026-123388 | High | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-122183 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-121292 | High | 2026-11-10 | Not applicable | No public exploit | A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging. |
| CVE-2026-119925 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119900 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119862 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Input System allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119846 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118725 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-118293 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118278 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118232 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118142 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118124 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-113758 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2026-111298 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-109806 | High | 2026-11-10 | Not applicable | No public exploit | SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality. |
| CVE-2026-109501 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-108421 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-108407 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105579 | High | 2026-11-10 | Not applicable | No public exploit | Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-105569 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105499 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105498 | High | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105028 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| CVE-2026-125211 | High | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap. |
| CVE-2026-123805 | High | 2026-11-09 | Not applicable | No public exploit | SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14. |
| CVE-2026-119610 | High | 2026-11-09 | Not applicable | No public exploit | A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents. |
| CVE-2026-119924 | High | 2026-11-06 | Not applicable | No public exploit | An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. |
| CVE-2026-92698 | High | 2026-11-05 | Not applicable | No public exploit | FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review. |
| CVE-2026-92697 | High | 2026-11-05 | Not applicable | Proof of concept only | FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review. |
| CVE-2026-92695 | High | 2026-11-05 | Not applicable | Proof of concept only | FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review. |
| CVE-2026-92693 | High | 2026-11-05 | Not applicable | Proof of concept only | FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review. |
| CVE-2026-76077 | High | 2026-11-05 | Not applicable | No public exploit | ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1. |
| CVE-2026-116784 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2. |
| CVE-2026-116782 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2. |
| CVE-2026-116568 | High | 2026-11-05 | Not applicable | No public exploit | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2. |
| CVE-2025-66367 | High | 2026-11-05 | Not applicable | No public exploit | Improper handling of NAS DLTransport messages may lead to a baseband crash. |
| CVE-2026-87041 | High | 2026-11-04 | Not applicable | No public exploit | The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on K_SYSCALL_VERIFY_MSG(), which yields !(expr)), so every buffer permission check contributed the opposite of its result. A submission whose tx.buf, rx.buf or txrx.tx_buf/txrx.rx_buf pointer was not accessible to the calling thread was accepted, while a legitimate, thread-owned buffer caused the calling thread to be killed with a kernel oops. The verifier runs on behalf of the rtio_sqe_copy_in_get_handles() system call (also reached through the inline rtio_sqe_copy_in() wrapper), so it is driven directly by untrusted user-mode input on any image built with CONFIG_USERSPACE. A user thread that has been granted an RTIO context and an rtio_iodev object — the intended usage of RTIO userspace support, established via rtio_access_grant() — can submit an SQE whose buffer pointer and length name arbitrary kernel memory; the object check on sqe->iodev is unaffected and still passes, and the crafted SQE is forwarded to the bus driver unchanged. Downstream consumers dereference the pointer with supervisor privilege. The generic I2C and I3C RTIO fallback handlers (drivers/i2c/i2c_rtio_default.c, drivers/i3c/i3c_rtio_default.c) copy sqe.rx.buf/sqe.tx.buf into struct i2c_msg and call i2c_transfer(), and the vendor SPI/I2C RTIO drivers behave equivalently. An RTIO_OP_RX submission therefore has peripheral data written into kernel memory of the attacker's choosing (arbitrary kernel write), an RTIO_OP_TX submission clocks kernel memory out over the bus (kernel memory disclosure), and a pointer to unmapped memory faults the kernel. This is a full escape from the user-mode isolation boundary that CONFIG_USERSPACE exists to enforce. The defect was masked for years because the in-tree user-mode RTIO tests only exercise RTIO_OP_NOP and mempool-backed reads, neither of which reaches the affected checks. The fix negates each K_SYSCALL_MEMORY() result and additionally validates the TXRX transmit buffer read-only, matching the SPI, I2C and I3C handlers. |
| CVE-2026-77372 | High | 2026-11-04 | Not applicable | No public exploit | VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size can overflow the heap allocation. VolumePassword::Deserialize accepts PasswordSize values larger than the fixed 128-byte PasswordBuffer, allowing downstream DataPtr() and Size() consumers such as the KDF to read beyond the buffer. DeserializeString, DeserializeWString, and the string and wide-string list readers also lack allocation and collection bounds, which can exhaust memory, and a zero-length DeserializeString can access an empty vector. Windows uses a different path, and the immediate CoreService pipe writer is the same-user parent process, so the documented exposure is a local defense-in-depth boundary rather than a remote attack. This issue is fixed in 1.26.30. |
| CVE-2026-17493 | High | 2026-11-04 | Not applicable | No public exploit | IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
| CVE-2026-121511 | High | 2026-11-03 | Not applicable | No public exploit | Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS |
| CVE-2026-121208 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121197 | High | 2026-11-03 | Not applicable | Proof of concept only | Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121184 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121160 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121140 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121112 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121084 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121032 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-120830 | High | 2026-11-03 | Not applicable | No public exploit | A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container. |
| CVE-2026-58924 | High | 2026-11-02 | Not applicable | No public exploit | The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles. |
| CVE-2026-58844 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-62958 | High | 2026-10-30 | Not applicable | Proof of concept only | libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18. |
| CVE-2026-61627 | High | 2026-10-30 | Not applicable | No public exploit | libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5. |
| CVE-2026-119722 | High | 2026-10-30 | Not applicable | No public exploit | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution. |
| CVE-2026-9535 | High | 2026-10-29 | Not applicable | No public exploit | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2026-90869 | High | 2026-10-29 | Not applicable | No public exploit | A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows. |
| CVE-2026-115942 | High | 2026-10-29 | Not applicable | No public exploit | A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. |
| CVE-2026-111735 | High | 2026-10-29 | Not applicable | No public exploit | P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content. |
| CVE-2026-111734 | High | 2026-10-29 | Not applicable | No public exploit | P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content. |
| CVE-2026-93862 | High | 2026-10-27 | Not applicable | No public exploit | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service. |
| CVE-2026-118346 | High | 2026-10-27 | Not applicable | No public exploit | Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118328 | High | 2026-10-27 | Not applicable | No public exploit | Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-86929 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution. |
| CVE-2026-82947 | High | 2026-10-26 | Not applicable | No public exploit | SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes. |
| CVE-2026-65384 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may cause an unexpected process termination. |
| CVE-2026-113944 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory. |
| CVE-2026-113942 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory. |
| CVE-2026-113941 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory. |
| CVE-2026-113912 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory. |
| CVE-2026-112622 | High | 2026-10-26 | Not applicable | No public exploit | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker in radio range may be able to cause unexpected system termination. |