Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,631

Export CSV
CVE-2020-13434

sqlite: integer overflow in sqlite3_str_vappendf function in printf.c

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Icloud Ipados Iphone Os and 13 more
CVE-2020-6096

glibc: signed comparison vulnerability in the ARMv7 memcpy function

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

CVSS 3.1 · 8.1 High EPSS 5.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu
Products
Debian Linux Fedora Glibc
CVE-2020-10878

perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVSS 3.1 · 8.6 High EPSS 4.9% KEV · Not listed
Vendors
Fedoraproject Netapp Opensuse and 3 more
Products
Fedora Oncommand Workflow Automation Snap Creator Framework and 19 more
CVE-2020-10531

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-5435

curl: Integer overflows in curl_url_set() function

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

CVSS 3.0 · 3.7 Low EPSS 5.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services
CVE-2019-3863

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 12 more
CVE-2019-3857

libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3856

libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3855

libssh2: Integer overflow in transport read resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Xcode Debian Linux Fedora and 15 more
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more
CVE-2019-16905

openssh: an integer overflow in the private key parsing code for the XMSS key type

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Netapp Openbsd Siemens
Products
Cloud Backup Steelstore Cloud Integrated Storage Openssh and 4 more
CVE-2018-18928

icu: integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp

International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Icu-project
Products
International Components For Unicode
CVE-2017-15422

chromium-browser: integer overflow in icu

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Google and 2 more
Products
Ubuntu Linux Debian Linux Chrome and 5 more
CVE-2026-88166

Microsoft Office SharePoint Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-107820

x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Duty1g
Products
X64dbg-mcp-server
CVE-2026-54697

ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107217

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Excelize Qax-os
Products
Excelize Excelize
CVE-2026-107224

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Excelize Qax-os
Products
Excelize Excelize