Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,318

Export CSV
CVE-2026-86020

Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Part-db
Products
Part-db
CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-114124

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Electron
Products
Electron
CVE-2025-60492

Stack Overflow in GPAC MP4Box Leading to Denial of Service

A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Mp4box
CVE-2026-93682

Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Php Php Group Redhat
Products
Php Php Hummingbird
CVE-2025-1218

Various packet overreads in mysqlnd_writeprotocol.c

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft Php Php Group
Products
Windows Php Php
CVE-2026-31694

fuse: reject oversized dirents in page cache

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Siemens
Products
Linux Kernel Simatic S7-1500 Tm Mfp Simatic S7-1500 Tm Mfp Firmware
CVE-2026-111678

Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Adri Van Os Antiword Project
Products
Antiword Antiword
CVE-2026-111165

libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Raphael Assenat Sezero
Products
Libmikmod Libmikmod
CVE-2026-111166

libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Raphael Assenat Sezero
Products
Libmikmod Libmikmod
CVE-2026-92208

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nomachine
Products
Nomachine
CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp