Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6,130

Export CSV
CVE-2026-81738

openvpn: OpenVPN: Out-of-bounds write via crafted DOMAIN-SEARCH entries

OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-18445

Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ni
Products
Labview
CVE-2026-86139

libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2024-42384

Integer Overflow or Wraparound in Mongoose Web Server library

Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cesanta
Products
Mongoose
CVE-2026-55400

Underflow‑Based Persistent Denial of Service in Absolute Secure Access

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Absolute
Products
Secure Access
CVE-2026-80908

drm/amdgpu: Reject UVD message with dimensions above 4096

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-80909

drm/amdgpu: Reject UVD message with invalid number of h265 refs

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-47857

Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Reactor Core Reactor Core
CVE-2026-69419

Azure Data Manager for Energy Remote Code Execution Vulnerability

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Data Manager For Energy
CVE-2026-80831

crypto: mxs-dcp - fix source scatterlist length access

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-64361

hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less than a typical node_size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer. Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-71223

gfs2-utils: gfs2-utils: integer overflow in resource group allocation size on 32-bit platforms

An integer overflow vulnerability was found in gfs2-utils. The resource group allocation size computation on 32-bit platforms causes an undersized buffer allocation followed by heap out-of-bounds writes when processing crafted GFS2 filesystem images. This vulnerability does not affect 64-bit builds.

CVSS 3.1 · 7.0 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Gfs2-utils
CVE-2026-84141

Integer overflow in the Graphics: ImageLib component

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-48486

Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1,029,000) enabled fee cash-back and burn accounting without overflow protection. This issue has been patched in version 3.9.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Signum-network
Products
Signum-node
CVE-2026-18309

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29401.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18308

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29405.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18306

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SGI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29396.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp
CVE-2026-18305

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29406.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp
Products
Gimp