Export limit exceeded: 16509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,509

Export CSV
CVE-2026-71263

FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Cwalter-at
Products
Freemodbus
CVE-2026-71255

nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Debevv
Products
Nanomodbus
CVE-2026-71254

nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Debevv
Products
Nanomodbus
CVE-2026-54410

nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debevv
Products
Nanomodbus
CVE-2026-3298

Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-19173

chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium

Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-19159

chromium-browser: Chromium: Arbitrary code execution via use-after-free in Views

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-19156

chromium-browser: Google Chrome: Heap buffer overflow allows heap corruption via malicious extension

Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-19148

chromium-browser: Google Chrome: Sandbox escape via out-of-bounds write in GPU

Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google Linux
Products
Chrome Linux Kernel
CVE-2026-19157

chromium-browser: ANGLE: Sandbox escape via out-of-bounds write in Google Chrome on Android

Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-19162

chromium-browser: Chromium: Arbitrary code execution via out-of-bounds write in V8.

Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-17264

Medixant RadiAnt DICOM Out-of-bounds write

Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Medixant
Products
Radiant Dicom
CVE-2026-55130

Microsoft Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2019 Office 2021 and 7 more
CVE-2026-67858

open62541: open62541: Denial of Service via buffer overflow in Local Discovery Server

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Open62541
Products
Open62541
CVE-2024-41056

firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files

In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2026-24253

Out-of-Bounds Write in NVIDIA Dynamo for Linux Enables Denial of Service and Data Tampering

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Dynamo
CVE-2026-21048

Out-of-Bounds Memory Write in Samsung DNG Parser

Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Samsung Mobile
Products
Samsung Mobile Devices
CVE-2026-6100

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-43816

Out-of-Bounds Write Causing Unexpected System Termination

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 4 more