Export limit exceeded: 12717 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29207 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65108 | 1 Nvidia | 1 Slurm | 2026-11-06 | 6.3 Medium |
| NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions. | ||||
| CVE-2026-120755 | 2 Hdfgroup, The Hdf Group | 2 Hdf5, Szip Filter | 2026-11-06 | 5.5 Medium |
| HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected. | ||||
| CVE-2026-65138 | 1 Nvidia | 1 Slurm | 2026-11-06 | 6.3 Medium |
| NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys. | ||||
| CVE-2026-65165 | 1 Nvidia | 1 Slurm | 2026-11-06 | 5.3 Medium |
| NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation. | ||||
| CVE-2026-65168 | 1 Nvidia | 1 Slurm | 2026-11-06 | 7 High |
| NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code. | ||||
| CVE-2026-121602 | 1 Solanum-ircd | 1 Solanum | 2026-11-06 | 6.5 Medium |
| Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution. | ||||
| CVE-2026-121603 | 1 Solanum-ircd | 1 Solanum | 2026-11-06 | 6.5 Medium |
| Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution. | ||||
| CVE-2026-121625 | 1 Willamowius | 1 Gnugk | 2026-11-06 | 3.7 Low |
| GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper. | ||||
| CVE-2026-121941 | 1 Munt | 1 Libmt32emu | 2026-11-06 | 7.8 High |
| libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application. | ||||
| CVE-2026-121968 | 1 Quozl | 1 Netrek-client-cow | 2026-11-06 | 6.5 Medium |
| Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service. | ||||
| CVE-2026-121969 | 1 Quozl | 1 Netrek-client-cow | 2026-11-06 | 6.5 Medium |
| netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client. | ||||
| CVE-2026-48175 | 1 Samsung Semiconductor | 11 Exynos 1280, Exynos 1330, Exynos 1380 and 8 more | 2026-11-06 | 5.5 Medium |
| Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. | ||||
| CVE-2026-73471 | 1 Gstreamer | 1 Gst-plugins-good | 2026-11-06 | 6.1 Medium |
| A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). | ||||
| CVE-2026-111959 | 1 Apache | 1 Arrow Rust | 2026-11-06 | 9.1 Critical |
| Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue. | ||||
| CVE-2026-120775 | 1 Tanium | 1 Deploy | 2026-11-06 | 7.2 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Deploy. | ||||
| CVE-2026-120431 | 1 Netpbm Project | 1 Netpbm | 2026-11-06 | 7.8 High |
| Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution. | ||||
| CVE-2026-120281 | 1 Wavlink | 1 Wn536ax6-a | 2026-11-06 | 10 Critical |
| A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-116648 | 1 Tanium | 1 Discover | 2026-11-06 | 4.1 Medium |
| Tanium addressed an improper output sanitization vulnerability in Discover. | ||||
| CVE-2025-71450 | 1 Benhoyt | 1 Inih | 2026-11-06 | 3.3 Low |
| inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers. | ||||
| CVE-2026-96546 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-06 | 2.5 Low |
| A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated. | ||||