Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,319

Export CSV
CVE-2026-96202

Windows Raw Image Extension Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Chromium Raw Image Extension
CVE-2026-83851

Windows Partition Management Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more
CVE-2026-116632

Facetime protocol handler enabled spoofing

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox For Ios
CVE-2026-92152

F´: Unvalidated Port Index in GenericHub

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Nasa
Products
Fprime
CVE-2026-73261

Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cesanta
Products
Mongoose
CVE-2026-53921

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Openwrt
Products
Odhcpd
CVE-2026-114348

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webpack.js
Products
Webpack-dev-server
CVE-2026-90458

openstack-ironic: openstack-ironic: Redfish vendor_passthru subscription id path traversal

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Ironic
CVE-2026-115722

RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Diegonehab
Products
Rply
CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-96639

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Python Python-pillow
Products
Pillow Pillow
CVE-2026-93857

Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-48379

Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)

Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Substance 3d Painter
CVE-2026-103780

Dell PowerProtect Data Domain Remote Command Execution via Stack-based Buffer Overflow

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain
CVE-2026-103593

Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-93862

Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os