Export limit exceeded: 424029 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12012 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115485 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-05 | 6.3 Medium |
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message. | ||||
| CVE-2026-115484 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-05 | 7.6 High |
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration. | ||||
| CVE-2025-71439 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-11-05 | 5.5 Medium |
| llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash. | ||||
| CVE-2025-5318 | 2 Libssh, Redhat | 11 Libssh, Ai Inference Server, Enterprise Linux and 8 more | 2026-11-05 | 5.4 Medium |
| A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior. | ||||
| CVE-2026-106061 | 3 Gimp, Red Hat, Redhat | 4 Gimp, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory. | ||||
| CVE-2026-104043 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS). | ||||
| CVE-2026-104042 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash. | ||||
| CVE-2026-104037 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS). | ||||
| CVE-2026-104030 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services. | ||||
| CVE-2026-103641 | 2 Gegl, Redhat | 3 Gegl, Enterprise Linux, Rhel Els | 2026-11-05 | 5.5 Medium |
| A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader. | ||||
| CVE-2025-4969 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-05 | 6.5 Medium |
| A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read). | ||||
| CVE-2026-121049 | 1 Google | 1 Chrome | 2026-11-05 | 3.3 Low |
| Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) | ||||
| CVE-2026-112515 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-05 | 7.5 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2025-2784 | 2 Gnome, Redhat | 26 Libsoup, Codeready Linux Builder, Codeready Linux Builder For Arm64 and 23 more | 2026-11-05 | 7 High |
| A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. | ||||
| CVE-2026-112561 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-05 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. | ||||
| CVE-2025-32914 | 1 Redhat | 6 Enterprise Linux, Rhel Aus, Rhel E4s and 3 more | 2026-11-05 | 7.4 High |
| A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. | ||||
| CVE-2026-19654 | 2 Redhat, Rsyslog | 10 Enterprise Linux, Enterprise Linux Eus, Rhel Aus and 7 more | 2026-11-05 | 7.5 High |
| A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. | ||||
| CVE-2025-14104 | 1 Redhat | 8 Ceph Storage, Cert Manager, Enterprise Linux and 5 more | 2026-11-05 | 6.1 Medium |
| A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database. | ||||
| CVE-2025-54325 | 1 Samsung | 25 Exynos, Exynos 1080, Exynos 1080 Firmware and 22 more | 2026-11-05 | 5.3 Medium |
| An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000. A race condition in the VTS driver results in an out-of-bounds read, leading to an information leak. | ||||
| CVE-2026-112525 | 1 Apple | 1 Macos | 2026-11-05 | 7.1 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||