Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,316

Export CSV
CVE-2026-102558

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 7 more
CVE-2026-102557

Libsoup: libsoup: heap buffer overflow during websocket message reassembly

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 7 more
CVE-2026-102555

Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding

A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 2 more
CVE-2026-112260

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-112257

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-40454

Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Iotdb C++ Client
CVE-2026-89126

Memory Corruption vulnerability in SAP Web Dispatcher

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-124317

libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-124057

TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
Ca300-poe Ca300-poe Firmware
CVE-2026-123958

TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
Ca300-poe Ca300-poe Firmware
CVE-2026-112335

Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull

Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh
CVE-2026-15028

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Cost Management On Premise and 7 more
CVE-2026-12478

Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Libsoup Red Hat Redhat
Products
Libsoup Enterprise Linux Enterprise Linux and 1 more
CVE-2026-49170

Windows StateRepository API Server file Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 13 more