Export limit exceeded: 55523 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 55,523

Export CSV
CVE-2026-2369

Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 1 more
CVE-2026-121956

FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2025-1675

Out of bounds read in dns_copy_qname

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2026-117984

Incorrect boundary conditions in the Layout: Scrolling and Overflow component

Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-117990

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-117991

Incorrect boundary conditions in the Layout: Text and Fonts component

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-18728

Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Open Iscsi
CVE-2026-18727

Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2026-16768

Gdk-pixbuf: out-of-bounds read in ico parser

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-16560

389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Directory Server Enterprise Linux Rhel Els
CVE-2026-1940

Gstreamer: incomplete fix of cve-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Freedesktop Gstreamer and 1 more
Products
Debian Linux Gst-plugins-good Gstreamer and 2 more
CVE-2026-121958

FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-93522

X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-x11-server Xwayland
CVE-2026-93518

X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-server Xorg-x11-server Xwayland
CVE-2026-93517

X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
X.org X.orgg
Products
X Server Xwayland Xorg-x11-server
CVE-2026-67079

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Aex
CVE-2026-57853

DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-104867

Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Immich-app
Products
Immich
CVE-2026-103411

Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper
Products
Session Smart Router
CVE-2026-103393

Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing

An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper
Products
Session Smart Router