Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,594

Export CSV
CVE-2026-53921

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Openwrt
Products
Odhcpd
CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-93857

Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-48379

Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)

Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Substance 3d Painter
CVE-2026-103780

Dell PowerProtect Data Domain Remote Command Execution via Stack-based Buffer Overflow

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain
CVE-2026-103593

Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-90732

Remote High-Privilege Network Attacker Can Trigger Buffer Overflow Leading to Denial of Service in Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain
CVE-2026-90731

Stack-based Buffer Overflow in Dell PowerProtect Data Domain Allowing Remote Denial of Service

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain
CVE-2026-90725

Stack‑based Buffer Overflow in Dell PowerProtect Data Domain Leading to Denial of Service

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain
CVE-2026-116738

VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kisli
Products
Vmime
CVE-2026-9659

Stack-Based Buffer Overflow in Totolink X2000R boa formFilter Allows Remote Code Execution

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42020

Stack-Based Buffer Overflow in Totolink X2000R Boa formIpv6Setup PPPoE Enables Remote Code Execution

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42019

Stack-based Buffer Overflow in Totolink X2000R PPPoE DNS Parameter Leading to Arbitrary Code Execution

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-41223

Stack-based buffer overflow in Totolink X2000R enables remote code execution

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-41222

Stack-based buffer overflow in Totolink X2000R formParentControl allows arbitrary code execution

A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r