WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-190✕
Overview 3,951 matches · 27 in Waratek scope · 0 protected · 34 exploited · 22 CISA KEV · 71 public PoC · 26 EPSS ≥ 0.5
3,951matches 27in Waratek scope0.7% 0protected0.0% 34exploited0.9% 22CISA KEV0.6% 71public PoC1.8% 26EPSS ≥ 0.50.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 27 0.7% Outside Waratek scope 36 0.9% Not applicable 3,888 98.4% Withdrawn CVE 0 0.0%
Critical 540 13.7% High 2,405 60.9% Medium 912 23.1% Low 93 2.4% None 1 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3,951 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 34 0.9% Working exploit published 34 0.9% Proof of concept only 290 7.3% Forecast only 8 0.2% No public exploit 3,585 90.7%
split by peak 1,067 / year
Not applicable: 3,888Outside Waratek scope: 36No exploit published: 27 None: 1Low: 93Medium: 912High: 2,405Critical: 540 not blocked: 3,951 No public exploit: 3,585Forecast only: 8Proof of concept only: 290Working exploit published: 34Exploited: 34
20022 Not applicable2 Critical2 not blocked2 Forecast only1 No public exploit1 20030 20043 Not applicable3 High1 Medium2 not blocked3 No public exploit3 20054 Not applicable4 Critical3 High1 not blocked4 No public exploit4 20062 Not applicable2 High2 not blocked2 No public exploit2 20079 Not applicable9 Critical1 High4 Medium4 not blocked9 Working exploit published3 No public exploit6 200813 Not applicable13 High9 Medium4 not blocked13 Exploited1 Working exploit published2 No public exploit10 20095 Outside Waratek scope1 Not applicable4 High5 not blocked5 No public exploit5 201019 Not applicable19 Critical4 High10 Medium5 not blocked19 Exploited1 Working exploit published1 No public exploit17 201116 Not applicable16 Critical1 High6 Medium9 not blocked16 Exploited1 Working exploit published1 No public exploit14 201218 Not applicable18 High10 Medium8 not blocked18 Exploited1 Proof of concept only2 No public exploit15 201314 Not applicable14 Critical2 High8 Medium4 not blocked14 Exploited2 Working exploit published2 No public exploit10 201412 No exploit published1 Not applicable11 High4 Medium8 not blocked12 Exploited1 No public exploit11 201515 No exploit published1 Not applicable14 Critical1 High8 Medium6 not blocked15 Exploited1 Working exploit published1 No public exploit13 201670 Not applicable70 Critical19 High43 Medium8 not blocked70 Exploited1 Working exploit published1 No public exploit68 2017223 Outside Waratek scope1 Not applicable222 Critical46 High133 Medium43 Low1 not blocked223 Working exploit published4 Proof of concept only1 No public exploit218 2018725 No exploit published1 Outside Waratek scope3 Not applicable721 Critical70 High610 Medium44 Low1 not blocked725 Exploited6 Working exploit published8 No public exploit711 2019220 Outside Waratek scope11 Not applicable209 Critical38 High132 Medium49 Low1 not blocked220 Working exploit published2 Proof of concept only4 No public exploit214 2020202 Outside Waratek scope6 Not applicable196 Critical30 High102 Medium51 Low19 not blocked202 Working exploit published1 Forecast only1 No public exploit200 2021241 No exploit published1 Outside Waratek scope6 Not applicable234 Critical52 High130 Medium55 Low4 not blocked241 Exploited4 Working exploit published2 Proof of concept only3 Forecast only2 No public exploit230 2022238 No exploit published1 Outside Waratek scope4 Not applicable233 Critical47 High121 Medium70 not blocked238 Exploited2 Working exploit published1 Proof of concept only33 Forecast only1 No public exploit201 2023264 No exploit published3 Not applicable261 Critical50 High153 Medium58 Low3 not blocked264 Exploited6 Proof of concept only36 Forecast only2 No public exploit220 2024286 No exploit published2 Outside Waratek scope1 Not applicable283 Critical43 High154 Medium83 Low6 not blocked286 Exploited1 Proof of concept only37 Forecast only1 No public exploit247 2025283 No exploit published1 Outside Waratek scope1 Not applicable281 Critical19 High153 Medium98 Low13 not blocked283 Exploited1 Working exploit published4 Proof of concept only36 No public exploit242 20261,067 No exploit published16 Outside Waratek scope2 Not applicable1,049 Critical112 High606 Medium303 Low45 None1 not blocked1,067 Exploited5 Working exploit published1 Proof of concept only138 No public exploit923
2002200420062008201020122014201620182020202220242026
3,951 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 40 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-129135 Medium 2026-11-13 Not applicable No public exploit picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
CVE-2026-109095 Medium 2026-11-13 Not applicable No public exploit A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.
CVE-2026-109094 High 2026-11-13 Not applicable No public exploit A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.
CVE-2026-107524 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.
CVE-2026-107523 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.
CVE-2026-103645 Low 2026-11-13 Not applicable No public exploit An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
CVE-2026-120139 High 2026-11-12 Not applicable No public exploit Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116328 High 2026-11-12 Not applicable No public exploit Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
CVE-2026-63660 High 2026-11-11 Not applicable No public exploit node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
CVE-2026-126916 High 2026-11-11 Not applicable No public exploit Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126876 High 2026-11-11 Not applicable No public exploit Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126149 High 2026-11-11 Not applicable No public exploit A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.
CVE-2026-124746 Medium 2026-11-11 Not applicable No public exploit A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.
CVE-2026-96982 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-96979 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-96974 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-96134 High 2026-11-10 Not applicable No public exploit Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
CVE-2026-96067 Critical 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
CVE-2026-96054 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.
CVE-2026-96036 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-95935 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95891 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.
CVE-2026-94527 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
CVE-2026-92863 High 2026-11-10 Not applicable No public exploit Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.
CVE-2026-91755 High 2026-11-10 Not applicable No public exploit Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
CVE-2026-88227 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-76973 High 2026-11-10 Not applicable No public exploit Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
CVE-2026-60133 Medium 2026-11-10 Not applicable No public exploit Integer overflow in the MigTD vsock for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-59986 High 2026-11-10 Not applicable Proof of concept only rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.
CVE-2026-59582 High 2026-11-10 Not applicable No public exploit In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58690 High 2026-11-10 Not applicable No public exploit In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56980 High 2026-11-10 Not applicable No public exploit In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-41221 High 2026-11-10 Not applicable No public exploit Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
CVE-2026-123378 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-123377 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-119995 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-119966 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-119940 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to deny service over a network.
CVE-2026-119921 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.
CVE-2026-119881 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-119858 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-119831 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-118295 High 2026-11-10 Not applicable No public exploit Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118280 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-118279 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-116700 Medium 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges with a physical attack.
CVE-2026-113847 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-113816 Medium 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.
CVE-2026-113765 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.
CVE-2026-113749 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
CVE-2026-112987 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-112985 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-112972 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.
CVE-2026-112760 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally.
CVE-2026-111310 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-109807 High 2026-11-10 Not applicable No public exploit SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
CVE-2026-108405 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-105579 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
CVE-2026-105578 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-105525 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
CVE-2026-125267 High 2026-11-09 Not applicable No public exploit FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
CVE-2026-125259 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.
CVE-2026-125253 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.
CVE-2026-125251 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.
CVE-2026-125249 High 2026-11-09 Not applicable No public exploit FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
CVE-2026-125248 High 2026-11-09 Not applicable No public exploit FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
CVE-2026-125247 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.
CVE-2026-125234 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate with many channels, to hang applications transcoding to WavPack.
CVE-2026-125230 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.
CVE-2026-125227 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filter_units, to corrupt the heap or crash the application.
CVE-2026-125222 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.
CVE-2026-125100 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.
CVE-2026-124001 Critical 2026-11-09 Not applicable No public exploit NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
CVE-2026-73472 Medium 2026-11-06 Not applicable No public exploit A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVE-2026-69005 High 2026-11-05 Not applicable No public exploit Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
CVE-2026-68984 High 2026-11-05 Not applicable No public exploit In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
CVE-2026-116787 High 2026-11-05 Not applicable No public exploit FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
CVE-2026-112109 High 2026-11-05 Not applicable No public exploit A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
CVE-2026-107891 High 2026-11-05 Not applicable No public exploit musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
CVE-2026-18142 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
CVE-2026-122130 High 2026-11-04 Not applicable No public exploit CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
CVE-2026-11376 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
CVE-2026-63418 High 2026-11-03 Not applicable No public exploit Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
CVE-2026-40659 Medium 2026-11-03 Not applicable No public exploit An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).
CVE-2026-121382 High 2026-11-03 Not applicable No public exploit A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-121259 Medium 2026-11-03 Not applicable No public exploit A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
CVE-2026-121219 High 2026-11-03 Not applicable No public exploit Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-120954 Medium 2026-11-03 Not applicable No public exploit A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.
CVE-2026-108324 Medium 2026-11-03 Not applicable No public exploit Tanium addressed a denial of service vulnerability in Tanium Client.
CVE-2026-100493 Medium 2026-11-03 Not applicable No public exploit An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
CVE-2026-68588 Medium 2026-11-02 Not applicable No public exploit In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920.
CVE-2026-58990 Medium 2026-11-02 Not applicable No public exploit In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58971 Medium 2026-11-02 Not applicable No public exploit In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58882 High 2026-11-02 Not applicable No public exploit In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58845 High 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58814 High 2026-11-02 Not applicable No public exploit In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55292 Medium 2026-11-02 Not applicable No public exploit In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120439 High 2026-11-02 Not applicable Proof of concept only QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
CVE-2026-120438 High 2026-11-02 Not applicable No public exploit QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
CVE-2026-120436 High 2026-11-02 Not applicable No public exploit Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.
‹ prev page 1 of 40 next ›