Export limit exceeded: 12051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,051

Export CSV
CVE-2026-50453

Windows USB Audio Class Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more
CVE-2026-50498

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more
CVE-2026-80101

Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 1 more
CVE-2026-18090

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-90994

Sssd: sssd: denial of service via malformed pam v1 requests

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Sssd
Products
Enterprise Linux Enterprise Linux Openshift and 3 more
CVE-2026-91786

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-109806

Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-121032

chromium-browser: Out of bounds read in Skia

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121197

chromium-browser: Out of bounds read in ANGLE

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome