WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-190✕
Overview 2,406 matches · 15 in Waratek scope · 0 protected · 28 exploited · 18 CISA KEV · 47 public PoC · 14 EPSS ≥ 0.5
2,406matches 15in Waratek scope0.6% 0protected0.0% 28exploited1.2% 18CISA KEV0.7% 47public PoC2.0% 14EPSS ≥ 0.50.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 15 0.6% Outside Waratek scope 21 0.9% Not applicable 2,370 98.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 2,406 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2,406 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 28 1.2% Working exploit published 21 0.9% Proof of concept only 145 6.0% Forecast only 4 0.2% No public exploit 2,208 91.8%
split by peak 610 / year
Not applicable: 2,370Outside Waratek scope: 21No exploit published: 15 High: 2,406 not blocked: 2,406 No public exploit: 2,208Forecast only: 4Proof of concept only: 145Working exploit published: 21Exploited: 28
20041 Not applicable1 High1 not blocked1 No public exploit1 20051 Not applicable1 High1 not blocked1 No public exploit1 20062 Not applicable2 High2 not blocked2 No public exploit2 20074 Not applicable4 High4 not blocked4 Working exploit published1 No public exploit3 20089 Not applicable9 High9 not blocked9 Exploited1 Working exploit published2 No public exploit6 20095 Outside Waratek scope1 Not applicable4 High5 not blocked5 No public exploit5 201010 Not applicable10 High10 not blocked10 Exploited1 No public exploit9 20116 Not applicable6 High6 not blocked6 Exploited1 No public exploit5 201210 Not applicable10 High10 not blocked10 Exploited1 Proof of concept only1 No public exploit8 20138 Not applicable8 High8 not blocked8 Exploited1 No public exploit7 20144 Not applicable4 High4 not blocked4 Exploited1 No public exploit3 20158 Not applicable8 High8 not blocked8 Exploited1 Working exploit published1 No public exploit6 201643 Not applicable43 High43 not blocked43 Exploited1 No public exploit42 2017133 Outside Waratek scope1 Not applicable132 High133 not blocked133 Working exploit published4 Proof of concept only1 No public exploit128 2018610 Not applicable610 High610 not blocked610 Exploited6 Working exploit published5 No public exploit599 2019132 Outside Waratek scope7 Not applicable125 High132 not blocked132 Working exploit published2 Proof of concept only2 No public exploit128 2020102 Outside Waratek scope4 Not applicable98 High102 not blocked102 Working exploit published1 Forecast only1 No public exploit100 2021130 Outside Waratek scope3 Not applicable127 High130 not blocked130 Exploited3 Working exploit published1 Proof of concept only3 Forecast only2 No public exploit121 2022121 Outside Waratek scope2 Not applicable119 High121 not blocked121 Exploited2 Proof of concept only18 No public exploit101 2023153 No exploit published3 Not applicable150 High153 not blocked153 Exploited3 Proof of concept only18 No public exploit132 2024154 Outside Waratek scope1 Not applicable153 High154 not blocked154 Exploited1 Proof of concept only23 Forecast only1 No public exploit129 2025153 No exploit published1 Outside Waratek scope1 Not applicable151 High153 not blocked153 Exploited1 Working exploit published4 Proof of concept only14 No public exploit134 2026607 No exploit published11 Outside Waratek scope1 Not applicable595 High607 not blocked607 Exploited4 Proof of concept only65 No public exploit538
200420062008201020122014201620182020202220242026
2,406 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 25 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-109094 High 2026-11-13 Not applicable No public exploit A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.
CVE-2026-107524 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.
CVE-2026-107523 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.
CVE-2026-120139 High 2026-11-12 Not applicable No public exploit Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116328 High 2026-11-12 Not applicable No public exploit Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
CVE-2026-63660 High 2026-11-11 Not applicable No public exploit node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
CVE-2026-126916 High 2026-11-11 Not applicable No public exploit Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126876 High 2026-11-11 Not applicable No public exploit Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126149 High 2026-11-11 Not applicable No public exploit A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.
CVE-2026-96134 High 2026-11-10 Not applicable No public exploit Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
CVE-2026-96054 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.
CVE-2026-96036 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-95935 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95891 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.
CVE-2026-94527 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
CVE-2026-92863 High 2026-11-10 Not applicable No public exploit Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.
CVE-2026-91755 High 2026-11-10 Not applicable No public exploit Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
CVE-2026-88227 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-76973 High 2026-11-10 Not applicable No public exploit Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
CVE-2026-59986 High 2026-11-10 Not applicable Proof of concept only rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.
CVE-2026-59582 High 2026-11-10 Not applicable No public exploit In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58740 High 2026-11-10 Not applicable No public exploit In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58690 High 2026-11-10 Not applicable No public exploit In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56980 High 2026-11-10 Not applicable No public exploit In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-41221 High 2026-11-10 Not applicable No public exploit Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
CVE-2026-123378 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-123377 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-119995 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-119966 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-119921 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.
CVE-2026-119881 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-119858 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-119831 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-118295 High 2026-11-10 Not applicable No public exploit Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118280 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-118279 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-113847 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-113765 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.
CVE-2026-113749 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
CVE-2026-112987 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-112985 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-112972 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.
CVE-2026-112760 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally.
CVE-2026-111310 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-109807 High 2026-11-10 Not applicable No public exploit SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
CVE-2026-108405 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-105579 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
CVE-2026-105578 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-105525 High 2026-11-10 Not applicable No public exploit Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
CVE-2026-125267 High 2026-11-09 Not applicable No public exploit FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
CVE-2026-125259 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.
CVE-2026-125251 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.
CVE-2026-125249 High 2026-11-09 Not applicable No public exploit FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
CVE-2026-125248 High 2026-11-09 Not applicable No public exploit FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
CVE-2026-125227 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filter_units, to corrupt the heap or crash the application.
CVE-2026-125222 High 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.
CVE-2026-69005 High 2026-11-05 Not applicable No public exploit Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
CVE-2026-68984 High 2026-11-05 Not applicable No public exploit In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
CVE-2026-116787 High 2026-11-05 Not applicable No public exploit FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
CVE-2026-112109 High 2026-11-05 Not applicable No public exploit A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
CVE-2026-107891 High 2026-11-05 Not applicable No public exploit musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
CVE-2026-18142 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
CVE-2026-122130 High 2026-11-04 Not applicable No public exploit CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
CVE-2026-11376 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
CVE-2026-63418 High 2026-11-03 Not applicable No public exploit Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
CVE-2026-121382 High 2026-11-03 Not applicable No public exploit A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-121219 High 2026-11-03 Not applicable No public exploit Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-58882 High 2026-11-02 Not applicable No public exploit In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58845 High 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58814 High 2026-11-02 Not applicable No public exploit In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120439 High 2026-11-02 Not applicable Proof of concept only QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
CVE-2026-120438 High 2026-11-02 Not applicable No public exploit QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
CVE-2026-120436 High 2026-11-02 Not applicable No public exploit Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.
CVE-2026-120432 High 2026-11-02 Not applicable No public exploit Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.
CVE-2026-120064 High 2026-11-02 Not applicable No public exploit Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
CVE-2026-19199 High 2026-10-30 Not applicable No public exploit Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.
CVE-2026-18629 High 2026-10-30 Not applicable No public exploit A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.
CVE-2026-119719 High 2026-10-30 Not applicable No public exploit Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.
CVE-2026-119718 High 2026-10-30 Not applicable No public exploit Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
CVE-2026-104064 High 2026-10-30 Not applicable No public exploit Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
CVE-2026-88077 High 2026-10-29 Not applicable No public exploit Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-86389 High 2026-10-28 Not applicable No public exploit Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVE-2026-86380 High 2026-10-28 Not applicable No public exploit Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-118370 High 2026-10-28 Not applicable No public exploit libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVE-2026-110747 High 2026-10-28 No exploit published No public exploit ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit. An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM. This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.
CVE-2026-106971 High 2026-10-28 Not applicable Proof of concept only An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP
CVE-2026-104016 High 2026-10-28 No exploit published No public exploit ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
CVE-2026-103410 High 2026-10-28 Not applicable No public exploit An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.
CVE-2026-118348 High 2026-10-27 Not applicable No public exploit Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-118009 High 2026-10-27 Not applicable No public exploit Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-117993 High 2026-10-27 Not applicable No public exploit Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-114596 High 2026-10-27 Not applicable No public exploit In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
CVE-2026-111585 High 2026-10-27 Not applicable Proof of concept only An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
CVE-2026-64759 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.
CVE-2026-116724 High 2026-10-26 Not applicable No public exploit FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
CVE-2026-116591 High 2026-10-26 Not applicable No public exploit compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.
CVE-2026-112565 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112519 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Connecting to a malicious VNC server may cause a denial-of-service.
CVE-2026-112449 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112417 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
‹ prev page 1 of 25 next ›