Overview 4,830 matches · 16 in Waratek scope · 0 protected · 9 exploited · 5 CISA KEV · 40 public PoC · 5 EPSS ≥ 0.5
4,830matches
16in Waratek scope0.3%
0protected0.0%
9exploited0.2%
5CISA KEV0.1%
40public PoC0.8%
5EPSS ≥ 0.50.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
16
0.3%
Outside Waratek scope
12
0.2%
Not applicable
4,802
99.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
4,830
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,326 / year
20046
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20050
20062
Not applicable2
Medium2
not blocked2
No public exploit2
20071
Not applicable1
Medium1
not blocked1
No public exploit1
20080
20090
20100
201125
Not applicable25
Medium25
not blocked25
No public exploit25
201216
Not applicable16
Medium16
not blocked16
No public exploit16
20132
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20144
Not applicable4
Medium4
not blocked4
No public exploit4
20152
Not applicable2
Medium2
not blocked2
No public exploit2
201636
Not applicable36
Medium36
not blocked36
Working exploit published2
No public exploit34
2017296
Outside Waratek scope1
Not applicable295
Medium296
not blocked296
Working exploit published15
Forecast only1
No public exploit280
2018388
Not applicable388
Medium388
not blocked388
Exploited2
Working exploit published5
Proof of concept only1
No public exploit380
2019381
Outside Waratek scope3
Not applicable378
Medium381
not blocked381
Working exploit published9
Proof of concept only2
No public exploit370
2020294
Outside Waratek scope4
Not applicable290
Medium294
not blocked294
Exploited1
No public exploit293
2021261
No exploit published1
Outside Waratek scope1
Not applicable259
Medium261
not blocked261
Proof of concept only2
No public exploit259
2022340
No exploit published1
Outside Waratek scope3
Not applicable336
Medium340
not blocked340
Exploited1
Proof of concept only15
Forecast only1
No public exploit323
2023547
Not applicable547
Medium547
not blocked547
Exploited4
Working exploit published1
Proof of concept only31
No public exploit511
2024533
No exploit published5
Not applicable528
Medium533
not blocked533
Proof of concept only33
No public exploit500
2025370
No exploit published6
Not applicable364
Medium370
not blocked370
Exploited1
Proof of concept only31
No public exploit338
20261,326
No exploit published3
Not applicable1,323
Medium1,326
not blocked1,326
Proof of concept only201
No public exploit1,125
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-64675 | Medium | 2026-11-13 | Not applicable | Proof of concept only | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0. |
| CVE-2026-62975 | Medium | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0. |
| CVE-2026-62972 | Medium | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0. |
| CVE-2026-58265 | Medium | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0. |
| CVE-2026-129217 | Medium | 2026-11-13 | Not applicable | No public exploit | In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0. |
| CVE-2026-128991 | Medium | 2026-11-13 | Not applicable | No public exploit | xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash. |
| CVE-2026-46677 | Medium | 2026-11-12 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1. |
| CVE-2026-126957 | Medium | 2026-11-12 | Not applicable | No public exploit | An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected. |
| CVE-2026-114469 | Medium | 2026-11-12 | Not applicable | No public exploit | Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size |
| CVE-2024-21963 | Medium | 2026-11-12 | Not applicable | No public exploit | An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability. |
| CVE-2026-64667 | Medium | 2026-11-11 | Not applicable | No public exploit | pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3. |
| CVE-2026-126884 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126871 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126857 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-97006 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96989 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. |
| CVE-2026-96988 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96987 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96986 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96985 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96984 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96980 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96976 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96975 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96970 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-96112 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally. |
| CVE-2026-96093 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally. |
| CVE-2026-96086 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network. |
| CVE-2026-96082 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. |
| CVE-2026-96058 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-96041 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-95977 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Event Viewer allows an authorized attacker to disclose information locally. |
| CVE-2026-95946 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-95908 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. |
| CVE-2026-90832 | Medium | 2026-11-10 | Not applicable | No public exploit | bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload. The Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends. Exploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync. The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers. |
| CVE-2026-88231 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network. |
| CVE-2026-88211 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network. |
| CVE-2026-66333 | Medium | 2026-11-10 | Not applicable | No public exploit | AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also impact Confidentiality, and Availability. |
| CVE-2026-66332 | Medium | 2026-11-10 | Not applicable | No public exploit | AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also potentially impact Confidentiality and Availability. |
| CVE-2026-59628 | Medium | 2026-11-10 | Not applicable | No public exploit | In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55716 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in the CheckUefiVgaMode for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-50249 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in the GenerationSetup for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-50078 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM. |
| CVE-2026-40424 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-40216 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-33571 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-28746 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-14918 | Medium | 2026-11-10 | Not applicable | No public exploit | The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. |
| CVE-2026-125706 | Medium | 2026-11-10 | Not applicable | No public exploit | A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service. |
| CVE-2026-125135 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-124179 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-124178 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-122518 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-122162 | Medium | 2026-11-10 | Not applicable | No public exploit | Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally. |
| CVE-2026-121678 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-121677 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-119999 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-119971 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-119970 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| CVE-2026-119940 | Medium | 2026-11-10 | Not applicable | No public exploit | Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network. |
| CVE-2026-119890 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network. |
| CVE-2026-119889 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-119838 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. |
| CVE-2026-119395 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Storport.sys Driver allows an authorized attacker to disclose information with a physical attack. |
| CVE-2026-118728 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-118727 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-118300 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-118200 | Medium | 2026-11-10 | Not applicable | No public exploit | Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-118199 | Medium | 2026-11-10 | Not applicable | No public exploit | Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-118143 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-118103 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-116940 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-116939 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-116932 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-115345 | Medium | 2026-11-10 | Not applicable | No public exploit | Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-113519 | Medium | 2026-11-10 | Not applicable | No public exploit | After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-113514 | Medium | 2026-11-10 | Not applicable | No public exploit | After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-11315 | Medium | 2026-11-10 | Not applicable | No public exploit | A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2026-112965 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| CVE-2026-112814 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112755 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows RNDIS allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-112754 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. |
| CVE-2026-112738 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-112720 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
| CVE-2026-111292 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-111291 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-111288 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-110066 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108425 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108424 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108423 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally. |
| CVE-2026-108419 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108418 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108417 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108408 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally. |
| CVE-2026-105568 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network. |
| CVE-2026-105552 | Medium | 2026-11-10 | Not applicable | No public exploit | An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory. |
| CVE-2026-105549 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Smart Card allows an authorized attacker to disclose information with a physical attack. |
| CVE-2026-105492 | Medium | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
| CVE-2026-0195 | Medium | 2026-11-10 | Not applicable | No public exploit | In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |