CVE-2026-101204

FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faststone

Products

Image Viewer

CVE-2026-97423

cxl/region: Validate partition index before array access

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-102717

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Netx Duo

CVE-2026-93345

MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. Attackers can repeatedly send a single BGP UPDATE packet carrying a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to indefinitely hold down the BGP plane, causing session termination without a NOTIFICATION and triggering a service malfunction on the device. The fix is carried only in 7.25beta4, a development build; the current stable release 7.24.2 and the current long-term release 7.23.5 both remain affected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-89028

MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-77219

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Emacs

CVE-2026-76641

Expat Out-of-Bounds Read via dtdCopy

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Libexpat Libexpat Project

Products

Expat Libexpat

CVE-2026-56719

MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-39919

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2026-102507

Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bishopfox

Products

Sliver

CVE-2020-37165

AbsoluteTelnet 11.12 - "license name" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license name field to trigger an application crash.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Celestial Software Celestialsoftware

Products

Absolutetelnet Absolutetelnet

CVE-2020-37164

AbsoluteTelnet 11.12 - "license entry" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Celestial Software Celestialsoftware

Products

Absolutetelnet Absolutetelnet

CVE-2020-37155

Core FTP Lite 1.3 - Denial of Service (PoC)

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Core Ftp Coreftp

Products

Core Ftp Lite Core Ftp

CVE-2020-37070

CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR)

CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through crafted network packets. Attackers can exploit the vulnerability by sending a specially crafted payload to the CloudMe service running on port 8888, enabling remote code execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cloudme

Products

Cloudme Sync

CVE-2018-25237

Hirschmann HiSecOS Buffer Overflow via HTTPS Login

Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash the device or execute arbitrary code by submitting a password longer than 128 characters. Attackers can exploit improper bounds checking in password handling to overflow a fixed-size buffer and achieve denial of service or remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Eagle One Hirschmann Hisecos

CVE-2026-101037

FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow

A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Fast

Products

Fac1200r

CVE-2026-101015

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Trusted Domain Project

Products

Opendmarc

CVE-2026-101003

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cesanta

Products

Mongoose

CVE-2026-47512

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via out-of-bounds read in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Nvs Quadro and 2 more

CVE-2026-69594

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 5 more