Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,053

Export CSV
CVE-2023-23454

kernel: slab-out-of-bounds read vulnerabilities in cbq_classify

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2015-4840

OpenJDK: OOB access in CMS code (2D, 8086092)

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2026-95114

libwebsockets: libwebsockets: Denial of Service via out-of-bounds read in LEJP parser

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Warmcat
Products
Libwebsockets
CVE-2023-3268

kernel: out-of-bounds access in relay_file_read

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2026-110658

Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Signalwire
Products
Sofia-sip
CVE-2026-105718

Microsoft Excel Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2021 and 5 more
CVE-2026-70263

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2021 and 4 more
CVE-2026-69922

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-70214

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-97755

Microsoft Office Excel Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2021 and 6 more
CVE-2022-48303

tar: heap buffer overflow at from_header() in list.c via specially crafted checksum

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Tar Enterprise Linux and 1 more
CVE-2022-47520

kernel: an out-of-bounds read in drivers/net/wireless/microchip/wilc1000/hif.c

An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel H300s and 9 more
CVE-2022-35260

curl: .netrc parser out-of-bounds access

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Clustered Data Ontap and 9 more
CVE-2026-102514

Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive

Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While decompressing a PCOMPRESS1 stream, the 32-bit compressed-block-size field of the first block (compsize) is read directly from the archive and used without validation as the length of a blockread into the fixed-size global buffers wbuf1/wbuf2 (1,114,112 bytes) and as the bound of the subsequent copy loop. The existing check "compsize > WBUFSIZE" is applied only to the size of each following block, so the first block escapes it; the same unvalidated value is also used to index wbuf1[compsize], an out-of-bounds read at an attacker-chosen offset. The copy loop additionally copies the requested length instead of the number of bytes actually read, and terminates on equality rather than on an upper bound. Because the project is built without range checking and no archive password, integrity tag or non-default configuration is required, the overflow overwrites adjacent global data; code execution was demonstrated by two independent researchers against the official Linux x86-64 and Windows x64 builds, and the denial-of-service and memory-corruption primitive is cross-platform (Windows, macOS, Linux, BSD).

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Peazip
Products
Peazip
CVE-2026-56136

Out-of-Bounds Read in NTFS-3G Allows Local Information Disclosure

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tuxera
Products
Ntfs-3g
CVE-2026-81507

ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Espressif
Products
Esp-idf
CVE-2022-3028

kernel: race condition in xfrm_probe_algs can lead to OOB read/write

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 3 more
CVE-2026-107817

MariaDB: mysql_json plugin OOB reads

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb
Products
Mariadb Server