Overview 113 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
113matches
0in Waratek scope0.0%
0protected0.0%
1exploited0.9%
1CISA KEV0.9%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.9%
Not applicable
112
99.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
113
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
0.9%
Working exploit published
0
0.0%
Proof of concept only
8
7.1%
Forecast only
0
0.0%
No public exploit
104
92.0%
split by
peak 30 / year
20171
Not applicable1
High1
not blocked1
No public exploit1
20180
20190
20202
Not applicable2
Critical1
High1
not blocked2
No public exploit2
20218
Not applicable8
High8
not blocked8
No public exploit8
20228
Not applicable8
High5
Medium3
not blocked8
Proof of concept only1
No public exploit7
202317
Not applicable17
Critical2
High12
Medium3
not blocked17
Exploited1
Proof of concept only4
No public exploit12
202422
Not applicable22
Critical4
High11
Medium7
not blocked22
No public exploit22
202525
Not applicable25
High18
Medium6
Low1
not blocked25
No public exploit25
202630
Outside Waratek scope1
Not applicable29
Critical3
High20
Medium5
Low2
not blocked30
Proof of concept only3
No public exploit27
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-60138 | High | 2026-11-10 | Not applicable | No public exploit | Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-105541 | High | 2026-11-10 | Not applicable | No public exploit | Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-74915 | High | 2026-10-30 | Not applicable | No public exploit | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device. |
| CVE-2026-74912 | Critical | 2026-10-30 | Not applicable | No public exploit | On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and limits the functionality of the kernel mode driver. |
| CVE-2026-93862 | High | 2026-10-27 | Not applicable | No public exploit | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service. |
| CVE-2026-107570 | Low | 2026-10-08 | Not applicable | No public exploit | heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template. |
| CVE-2026-104944 | High | 2026-10-06 | Not applicable | No public exploit | TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition. |
| CVE-2026-102757 | High | 2026-09-29 | Not applicable | No public exploit | An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range. |
| CVE-2026-48977 | High | 2026-09-17 | Not applicable | No public exploit | OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1. |
| CVE-2026-31912 | Medium | 2026-09-05 | Not applicable | No public exploit | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. |
| CVE-2026-45199 | High | 2026-08-21 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges. |
| CVE-2026-72642 | High | 2026-08-13 | Not applicable | No public exploit | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. |
| CVE-2026-49746 | High | 2026-08-07 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages. |
| CVE-2026-49745 | High | 2026-07-24 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges. |
| CVE-2026-49744 | High | 2026-07-24 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries. |
| CVE-2026-21734 | High | 2026-06-26 | Not applicable | No public exploit | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write. |
| CVE-2026-12290 | High | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-46244 | Critical | 2026-06-03 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization. |
| CVE-2026-34193 | Medium | 2026-06-01 | Not applicable | No public exploit | Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory. |
| CVE-2026-28764 | High | 2026-05-21 | Not applicable | No public exploit | A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2026-42946 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41907 | High | 2026-04-24 | Not applicable | Proof of concept only | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0. |
| CVE-2026-4693 | High | 2026-03-24 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
| CVE-2025-33215 | Medium | 2026-03-24 | Not applicable | No public exploit | NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of storage to other VMs. |
| CVE-2026-32829 | High | 2026-03-20 | Not applicable | No public exploit | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1. |
| CVE-2026-21732 | Critical | 2026-03-20 | Not applicable | No public exploit | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access. |
| CVE-2026-20022 | Medium | 2026-03-04 | Outside Waratek scope | No public exploit | A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition. |
| CVE-2025-54152 | Low | 2026-02-11 | Not applicable | No public exploit | A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later |
| CVE-2026-23764 | Medium | 2026-01-22 | Not applicable | Proof of concept only | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems. |
| CVE-2026-21487 | High | 2026-01-06 | Not applicable | Proof of concept only | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2. |
| CVE-2017-20211 | High | 2025-11-12 | Not applicable | No public exploit | UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file). |
| CVE-2025-11232 | High | 2025-10-29 | Not applicable | No public exploit | To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2. |
| CVE-2025-47349 | High | 2025-10-09 | Not applicable | No public exploit | Memory corruption while processing an escape call. |
| CVE-2025-27059 | High | 2025-10-09 | Not applicable | No public exploit | Memory corruption while performing SCM call. |
| CVE-2025-25180 | High | 2025-07-14 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. |
| CVE-2024-53017 | Medium | 2025-06-03 | Not applicable | No public exploit | Memory corruption while handling test pattern generator IOCTL command. |
| CVE-2025-46806 | Medium | 2025-06-02 | Not applicable | No public exploit | A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4. |
| CVE-2024-47893 | Medium | 2025-05-17 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory. |
| CVE-2024-45570 | High | 2025-05-06 | Not applicable | No public exploit | Memory corruption may occur during IO configuration processing when the IO port count is invalid. |
| CVE-2025-0467 | High | 2025-04-18 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-45557 | High | 2025-04-07 | Not applicable | No public exploit | Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. |
| CVE-2024-43060 | High | 2025-03-03 | Not applicable | No public exploit | Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. |
| CVE-2024-52939 | High | 2025-02-22 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory. |
| CVE-2024-47896 | Low | 2025-02-22 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-12577 | High | 2025-02-22 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-49840 | High | 2025-02-03 | Not applicable | No public exploit | Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality. |
| CVE-2024-45573 | High | 2025-02-03 | Not applicable | No public exploit | Memory corruption may occour while generating test pattern due to negative indexing of display ID. |
| CVE-2024-47900 | High | 2025-01-31 | Not applicable | No public exploit | Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory. |
| CVE-2024-52938 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory. |
| CVE-2024-52937 | Medium | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-52936 | Medium | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-52935 | Medium | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. |
| CVE-2024-47895 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory. |
| CVE-2024-47894 | High | 2025-01-13 | Not applicable | No public exploit | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory. |
| CVE-2024-33041 | High | 2025-01-06 | Not applicable | No public exploit | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
| CVE-2024-33036 | Medium | 2024-12-02 | Not applicable | No public exploit | Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access. |
| CVE-2017-11076 | Critical | 2024-11-26 | Not applicable | No public exploit | On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder. |
| CVE-2024-42391 | Medium | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. |
| CVE-2024-42390 | Medium | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. |
| CVE-2024-42389 | Medium | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. |
| CVE-2024-42388 | Medium | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. |
| CVE-2024-42387 | Medium | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. |
| CVE-2024-42386 | High | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. |
| CVE-2024-42383 | Critical | 2024-11-18 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field. |
| CVE-2024-23377 | Medium | 2024-11-04 | Not applicable | No public exploit | Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver. |
| CVE-2024-42416 | High | 2024-09-05 | Not applicable | No public exploit | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. |
| CVE-2024-6603 | High | 2024-07-09 | Not applicable | No public exploit | In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128. |
| CVE-2024-21475 | High | 2024-05-06 | Not applicable | No public exploit | Memory corruption when the payload received from firmware is not as per the expected protocol size. |
| CVE-2024-1013 | High | 2024-03-18 | Not applicable | No public exploit | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. |
| CVE-2023-43553 | Critical | 2024-03-04 | Not applicable | No public exploit | Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE. |
| CVE-2023-33066 | High | 2024-03-04 | Not applicable | No public exploit | Memory corruption in Audio while processing RT proxy port register driver. |
| CVE-2023-43534 | Critical | 2024-02-06 | Not applicable | No public exploit | Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. |
| CVE-2023-43516 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption when malformed message payload is received from firmware. |
| CVE-2023-43513 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. |
| CVE-2023-33067 | High | 2024-02-06 | Not applicable | No public exploit | Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points. |
| CVE-2023-33110 | High | 2024-01-02 | Not applicable | No public exploit | The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption. |
| CVE-2023-33033 | High | 2024-01-02 | Not applicable | No public exploit | Memory corruption in Audio during playback with speaker protection. |
| CVE-2023-6560 | Medium | 2023-12-09 | Not applicable | No public exploit | An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system. |
| CVE-2023-33106 | High | 2023-12-05 | Not applicable | Exploited | Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. |
| CVE-2023-33079 | High | 2023-12-05 | Not applicable | No public exploit | Memory corruption in Audio while running invalid audio recording from ADSP. |
| CVE-2023-22388 | Critical | 2023-11-07 | Not applicable | No public exploit | Memory Corruption in Multi-mode Call Processor while processing bit mask API. |
| CVE-2023-46724 | High | 2023-11-01 | Not applicable | No public exploit | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. |
| CVE-2023-24855 | Critical | 2023-10-03 | Not applicable | No public exploit | Memory corruption in Modem while processing security related configuration before AS Security Exchange. |
| CVE-2023-20187 | High | 2023-09-27 | Not applicable | No public exploit | A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect handling of certain IPv6 multicast packets when they are fanned out more than seven times on an affected device. An attacker could exploit this vulnerability by sending a specific IPv6 multicast or IPv6 multicast VPN (MVPNv6) packet through the affected device. A successful exploit could allow the attacker to cause a reload of the affected device, resulting in a DoS condition. |
| CVE-2023-28564 | High | 2023-09-05 | Not applicable | No public exploit | Memory corruption in WLAN HAL while passing command parameters through WMI interfaces. |
| CVE-2023-28575 | High | 2023-08-08 | Not applicable | No public exploit | The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it. |
| CVE-2023-22387 | High | 2023-07-04 | Not applicable | No public exploit | Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption. |
| CVE-2022-46378 | High | 2023-05-10 | Not applicable | Proof of concept only | An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no port argument is provided to the `PORT` command. |
| CVE-2022-46377 | High | 2023-05-10 | Not applicable | Proof of concept only | An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs when no IP address argument is provided to the `PORT` command. |
| CVE-2023-2426 | Medium | 2023-04-29 | Not applicable | Proof of concept only | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. |
| CVE-2022-25709 | High | 2023-03-10 | Not applicable | No public exploit | Memory corruption in modem due to use of out of range pointer offset while processing qmi msg |
| CVE-2022-25694 | High | 2023-03-10 | Not applicable | No public exploit | Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM |
| CVE-2022-33246 | High | 2023-02-12 | Not applicable | No public exploit | Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id. |
| CVE-2022-43665 | Medium | 2023-02-02 | Not applicable | Proof of concept only | A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-crafted PE file can lead to killing target process. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2022-42264 | High | 2022-12-30 | Not applicable | No public exploit | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data tampering, data loss, information disclosure, or denial of service. |
| CVE-2022-32142 | High | 2022-06-24 | Not applicable | No public exploit | Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required. |
| CVE-2022-21147 | Medium | 2022-05-12 | Not applicable | Proof of concept only | An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-crafted PE file can trigger this vulnerability to cause denial of service and termination of malware scan. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2022-1420 | Medium | 2022-04-21 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. |
| CVE-2022-0729 | High | 2022-02-23 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. |
| CVE-2022-0685 | High | 2022-02-20 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. |