Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,222

Export CSV
CVE-2026-32135

NanoMQ has Heap Buffer Overflow in URI Parameter Parsing

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Emqx Nanomq
Products
Nanomq Nanomq
CVE-2026-32961

Heap‑Based Buffer Overflow in Silex AMC Manager and SD‑330AC Causing Temporary Denial of Service

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing a crafted packet may cause a temporary denial-of-service (DoS) condition.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Silextechnology
Products
Amc Manager Sd-330ac Sd-330ac Firmware
CVE-2026-32956

Heap‑Based Buffer Overflow in Redirect URL Processing Allows Arbitrary Code Execution

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Silextechnology
Products
Amc Manager Sd-330ac Sd-330ac Firmware
CVE-2026-41445

KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mborgerding
Products
Kissfft
CVE-2015-3113

flash-plugin: code execution issue fixed in APSB15-14

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

CVSS 3.1 · 7.8 High EPSS 99.8% KEV · Listed
Vendors
Adobe Apple Hp and 5 more
Products
Flash Player Mac Os X Insight Orchestration and 16 more
CVE-2026-34627

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Indesign Indesign Desktop
CVE-2025-3522

Leak of hashed Window credentials via crafted attachment URL

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Thunderbird Enterprise Linux Rhel Aus and 3 more
CVE-2025-1943

Memory safety bugs fixed in Firefox 136 and Thunderbird 136

Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-64678

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-34540

iccDEV: HBO in icMemDump()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in icMemDump() when iccDumpProfile attempts to dump/describe malformed tag contents. The issue is observable under AddressSanitizer as an out-of-bounds heap read in icMemDump(...) at IccProfLib/IccUtil.cpp:1002, reachable via CIccTagUnknown::Describe(). This issue has been patched in version 2.3.1.6.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-34535

iccDEV: SEGV in CIccTagArray::Cleanup()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup(). The issue is observable under UBSan/ASan as misaligned member access / misaligned pointer loads followed by an invalid read leading to process crash when running iccRoundTrip on a malicious profile. This issue has been patched in version 2.3.1.6.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-21490

iccDEV has heap buffer overflow in CIccTagLut16::Validate()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in heap buffer overflow in `CIccTagLut16::Validate()`. Version 2.3.1.2 contains a patch. No known workarounds are available.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-0793

ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability

ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the InformaCast functionality. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28302.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Algo Algosolutions
Products
8180 Ip Audio Alerter 8180 Ip Audio Alerter 8180 Ip Audio Alerter Firmware
CVE-2026-21682

iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow in `CIccXmlArrayType::ParseText()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev