Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,319

Export CSV
CVE-2026-116581

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Lxsmnsyc
Products
Seroval
CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty-tcnative Netty-tcnative-boringssl-static
CVE-2026-116508

TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A950rg A950rg Firmware
CVE-2026-116488

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Nxp
Products
Mcuxsdk-middleware-usb
CVE-2026-115906

zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zip-rs
Products
Zip2
CVE-2026-116744

ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ntop
Products
Ndpi
CVE-2026-70125

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-79883

Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-61627

libass: Out-of-bounds read and write in wrap_lines_measure

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Libass
Products
Libass
CVE-2026-79859

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-81396

Microsoft Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 8 more
CVE-2026-78403

Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Thalesgroup
Products
Sentinel Keys Server
CVE-2026-57201

Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57185

Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-79860

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-79862

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-79863

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-104594

libosmocore: libosmocore: Information disclosure via out-of-bounds read in IPA CCM parser

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—