Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6,130

Export CSV
CVE-2026-65200

Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2022-42898

krb5: integer overflow vulnerabilities in PAC parsing

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

CVSS 3.1 · 8.8 High EPSS 6.9% KEV · Not listed
Vendors
Heimdal Project Mit Redhat and 1 more
Products
Heimdal Kerberos 5 Enterprise Linux and 7 more
CVE-2026-17507

MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bc-java
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-37454

XKCP: buffer overflow in the SHA-3 reference implementation

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

CVSS 3.1 · 9.8 Critical EPSS 7.4% KEV · Not listed
Vendors
Debian Extended Keccak Code Package Project Fedoraproject and 6 more
Products
Debian Linux Extended Keccak Code Package Fedora and 6 more
CVE-2026-110604

Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mini-xml Project
Products
Mini-xml
CVE-2022-29824

libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 23 more
CVE-2014-0227

Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

CVSS 2.0 · 6.4 Medium EPSS 21.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 8 more
CVE-2014-0099

Tomcat/JBossWeb: Request smuggling via malicious content length header

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CVSS 2.0 · 4.3 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 8 more
CVE-2022-3821

systemd: buffer overrun in format_timespan() function

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Systemd Project
Products
Fedora Enterprise Linux Rhel Eus and 1 more