Export limit exceeded: 396729 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396729 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396729 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69786 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-22 | 8.1 High |
| Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-59849 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 3.1 Low |
| A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service. | ||||
| CVE-2026-69790 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-22 | 7.8 High |
| Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-59842 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 3.7 Low |
| A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory. | ||||
| CVE-2026-44253 | 1 Wazuh | 1 Wazuh | 2026-09-22 | 4.9 Medium |
| Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2. | ||||
| CVE-2026-15370 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 6.7 Medium |
| A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server. | ||||
| CVE-2026-69791 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-22 | 7 High |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-55191 | 1 Freerdp | 1 Freerdp | 2026-09-22 | 9.8 Critical |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0. | ||||
| CVE-2026-69792 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-22 | 4.7 Medium |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-55192 | 1 Freerdp | 1 Freerdp | 2026-09-22 | 8.2 High |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0. | ||||
| CVE-2026-69793 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-22 | 7.5 High |
| Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-69794 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-22 | 5.5 Medium |
| Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-55564 | 1 Freerdp | 1 Freerdp | 2026-09-22 | 5.4 Medium |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0. | ||||
| CVE-2026-63652 | 1 Freerdp | 1 Freerdp | 2026-09-22 | 6.5 Medium |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0. | ||||
| CVE-2026-88807 | 1 X.org | 1 Libxrender | 2026-09-22 | 8.3 High |
| A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. | ||||
| CVE-2026-88806 | 1 X.org | 1 Libx11 | 2026-09-22 | 7.5 High |
| A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map. | ||||
| CVE-2026-95508 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-09-22 | 7.4 High |
| A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected. | ||||
| CVE-2026-76974 | 1 Sap | 1 Fiori Launchpad | 2026-09-22 | 5.3 Medium |
| SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability. | ||||
| CVE-2026-65128 | 1 Nvidia | 1 Infrastructure Controller | 2026-09-22 | 8.8 High |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | ||||
| CVE-2026-24267 | 1 Nvidia | 1 Nemo Speech | 2026-09-22 | 7.8 High |
| NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | ||||