Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,594

Export CSV
CVE-2026-15691

Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow

A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Be12 Pro
CVE-2026-15548

Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Shibby
Products
Tomato
CVE-2026-50387

Windows GDI Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Microsoft 365 Office and 23 more
CVE-2026-55134

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2019 and 10 more
CVE-2026-55038

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2019 and 10 more
CVE-2020-37136

ZOC Terminal v7.25.5 - 'Private key file' Denial of Service

ZOC Terminal 7.25.5 contains a denial of service vulnerability in the private key file input field that allows attackers to crash the application. Attackers can overwrite the private key file input with a 2000-byte buffer, causing the application to become unresponsive when attempting to create SSH key files.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ejinshan Emtec
Products
Terminal Security System Zoc Terminal
CVE-2020-37128

ZOC Terminal 7.25.5 - 'Script' Denial of Service

ZOC Terminal 7.25.5 contains a script processing vulnerability that allows local attackers to crash the application by loading a maliciously crafted REXX script file. Attackers can generate an oversized script with 20,000 repeated characters to trigger an application crash and cause a denial of service.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ejinshan Emtec
Products
Terminal Security System Zoc Terminal
CVE-2019-25332

FTP Commander Pro 8.03 - Local Stack Overflow

FTP Commander Pro 8.03 contains a local stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting the EIP register through a custom command input. Attackers can craft a malicious payload of 4108 bytes to overwrite memory and execute shellcode, demonstrating remote code execution potential.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Internet-soft
Products
Ftp Commander Ftp Commander Pro
CVE-2013-10036

Beetel Connection Manager NetConfig.ini Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution when the application processes the file.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Beetel Intel
Products
Connection Manager Connection Manager
CVE-2010-20107

FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow

A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Novell
Products
Data Synchronizer
CVE-2010-20042

Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer Overflow

Xion Audio Player versions 1.0.126 and prior are vulnerable to a Unicode-based stack buffer overflow triggered by opening a specially crafted .m3u playlist file. The file contains an overly long string that overwrites the Structured Exception Handler (SEH) chain, allowing an attacker to hijack execution flow and run arbitrary code.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Doryphores
Products
Audio Player
CVE-2026-4017

Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Qnx Os For Medical Qnx Os For Safety Qnx Software Development Platform
CVE-2025-34108

Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.

CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse
CVE-2026-34690

After Effects | Stack-based Buffer Overflow (CWE-121)

After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
After Effects Macos Windows
CVE-2026-10666

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len - end - 1, where str_len is the full, unbounded input length and end is only the (<=15-byte) offset of the ':' delimiter. Because the destination size is never consulted, a crafted address string with a long suffix after the colon (e.g. "1.2.3.4:" followed by hundreds of bytes) causes an out-of-bounds stack write whose length and contents are fully attacker-controlled (memcpy of the suffix plus a trailing NUL), enabling memory corruption and at minimum a denial of service, and potentially control-flow hijack. The parser is reached from the standard socket API (zsock_getaddrinfo / literal-address resolution), DNS server-string configuration, and the eswifi Wi-Fi co-processor DNS-response path, so an application that resolves a network-influenced address string is exposed. The bug was introduced when the parser was added (Zephyr v1.9.0) and shipped in all releases through v4.4.0. The fix removes the unbounded copy and validates the port length before copying into a small dedicated buffer. Note: the equivalent IPv6 "[addr]:port" path in parse_ipv6() retains the same unbounded copy at this commit and remains a separate, still-reachable instance of the defect.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject
Products
Zephyr
CVE-2026-22214

RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Riot-os Riot Project
Products
Riot Riot
CVE-2026-22213

RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Riot-os Riot Project
Products
Riot Riot
CVE-2026-15696

Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow

A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Be12 Pro