Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,322

Export CSV
CVE-2019-18224

libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Gnu Redhat
Products
Libidn2 Enterprise Linux
CVE-2019-17594

ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Invisible-island Opensuse Redhat
Products
Ncurses Leap Enterprise Linux
CVE-2019-17543

lz4: heap-based buffer overflow in LZ4_write32

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

CVSS 3.1 · 8.1 High EPSS 10.5% KEV · Not listed
Vendors
Lz4 Project
Products
Lz4
CVE-2019-15903

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Libexpat Project Python Redhat
Products
Libexpat Python Enterprise Linux and 2 more
CVE-2019-12900

bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail).

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

CVSS 3.1 · 9.8 Critical EPSS 8.0% KEV · Not listed
Vendors
Bzip Canonical Debian and 4 more
Products
Bzip2 Ubuntu Linux Debian Linux and 6 more
CVE-2019-11360

iptables: buffer overflow in iptables-restore

A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c.

CVSS 3.1 · 4.2 Medium EPSS 2.2% KEV · Not listed
Vendors
Netfilter
Products
Iptables
CVE-2017-9050

libxml2: Heap-based buffer over-read in function xmlDictAddString

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2017-9049

libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2017-9048

libxml2: Stack-based buffer overflow in function xmlSnprintfElementContent

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVSS 3.1 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2017-9047

libxml2: Buffer overflow in function xmlSnprintfElementContent

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2017-0663

libxml2: Heap buffer overflow in xmlAddID

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

CVSS 3.0 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-108573

Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Assimp
Products
Assimp
CVE-2026-78016

Improper Validation of Specified Input in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2026-108103

Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Open5gs
Products
Open5gs
CVE-2026-107738

SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sumatrapdfreader
Products
Sumatrapdf
CVE-2026-107723

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Nearform
Products
Fast-jwt
CVE-2026-105726

Microsoft Defender Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Defender For Endpoint