CVE-2026-15176

NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

F5

Products

Nginx Open Source Nginx Plus

CVE-2026-98678

iio: adc: ad4030: fix invalid oversampling_ratio validation

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversampling_ratio validation In ad4030_set_avg_frame_len(), the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2(). Validate that the input is strictly positive prior to computing its logarithm.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-67456

Heap‑Based Buffer Overflow in NVIDIA Warp Leading to Potential Denial of Service

NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Warp

CVE-2026-79825

HPE NonStop NDSREST - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ndsrest

CVE-2026-79826

HPE NonStop OCAX - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ocax

CVE-2026-79840

HPE NonStop XABroker - Memory corruption vulnerability

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Xabroker

CVE-2026-79843

HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Exe

CVE-2026-43834

Stack-based Buffer Overflow in Logs Settings of Advantech ADAM-3600

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-43856

Stack-Based Buffer Overflow in ADAM‑3600 CheckDir Function Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-113868

Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Thunderbird

CVE-2026-20218

Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability

A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;&nbsp; This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-63849

drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit e16be95a2c3ee712b142cb27d2dca0b461181359)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-63842

drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-43630

llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure

llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ggml Ggml-org

Products

Llama.cpp Llama.cpp

CVE-2026-96372

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-95638

Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Photoshop Macos Windows

CVE-2026-71084

mysql-connector-odbc: MySQL Connector/ODBC: Denial of Service via unauthenticated local access

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Connector/odbc Mysql Connector\/odbc Mysql Connectors

CVE-2026-114112

Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Lovell

Products

Sharp

CVE-2026-76004

UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Utt

Products

Hiper 1250gw

CVE-2026-76008

Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.

CVSS 4.0 · 10 Critical EPSS 1.0% KEV · Not listed

Vendors

Comfast

Products

Cf-n1-s