CVE-2026-123614

imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Evilmartians Imgproxy

Products

Imgproxy Imgproxy

CVE-2026-86919

Bluetooth Stack Overflow Enables Arbitrary Code Execution on Apple Devices

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios And Ipados Ipados Iphone Os and 2 more

CVE-2026-86957

Out‑of‑Bounds Read Causing Unexpected System Termination via Wireless Proximity

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios And Ipados Ipados Iphone Os and 4 more

CVE-2026-124563

D-Link DIR-878 HNAP SetWanSettings buffer overflow

A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-124560

D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-95867

Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management

IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Sevone Network Performance Management

CVE-2026-112627

Out-of-bounds read in image processing leading to process memory disclosure

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios And Ipados Ipados Iphone Os and 2 more

CVE-2026-83844

Windows Paint Remote Code Execution Vulnerability

Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Paint

CVE-2026-119924

Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser

An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Amazon Aws

Products

Amazon Aurora Postgresql With Babelfish Babelfish-for-postgresql

CVE-2026-119923

Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Amazon Aws

Products

Amazon Aurora Postgresql With Babelfish Babelfish-for-postgresql

CVE-2026-124058

TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware

CVE-2026-76457

Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under the Common Weakness Enumeration (CWE) CWE-125.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Nx-os System Software In Aci Mode Nx-os Software Unified Computing System Manager

CVE-2026-99272

smb: client: validate the data area in SMB2_read()

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() SMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from (char *)rsp + rsp->DataOffset without checking that the range lies within the response actually received. A READ response with DataOffset == 0 makes smb2_get_data_area_len() zero the data length, so smb2_check_message() accepts a frame as short as the fixed response, while SMB2_read() still uses the server-supplied DataLength, capped only by CIFS_MAX_MSGSIZE and the caller's length. A malicious server can answer the synchronous read used by the mfsymlinks (or SFU) symlink parser with an 81-byte READ response carrying DataOffset 0 and DataLength 1067, making the client copy 1067 bytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to 16 KiB in the general case). Clamp a zero (or header-overlapping) DataOffset to read_rsp_size, as handle_read_data() does for the asynchronous path, and reject the response unless DataOffset + DataLength fits within rsp_iov.iov_len. The SMB1 helper was fixed the same way in 5be5bdda5863.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Linux Kernel

CVE-2026-99275

smb: client: reject short SESSION_SETUP responses

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSION_SETUP responses smb2_check_message() accepts frames shorter than struct smb2_pdu when the SMB2 status is non-zero, before the minimum-PDU check added by b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP response is therefore accepted even though it cannot contain the SecurityBufferOffset and SecurityBufferLength fields. The parser then reads those fields from stale bytes left in the reused receive buffer by an earlier frame. With a long stale SecurityBufferLength, decode_ntlmssp_challenge() copies up to about 64 KB from beyond the receive object and sends the data back to the server in the NTLMv2 AUTHENTICATE target info. Reject short MPR SESSION_SETUP responses before the short-error path, and validate SecurityBufferOffset + SecurityBufferLength against the received response length before decoding the challenge. The ordering bypass is not new: the short-error early return predates b4694f269e66d, and the unvalidated SecurityBufferLength read predates the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable trees are affected. Reproduced on 6.6.87.2; the path is unchanged on mainline.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Linux Kernel

CVE-2023-39197

Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 1 more

CVE-2023-4527

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Glibc H300s and 30 more

CVE-2023-3773

Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 2 more

CVE-2023-39418

Postgresql: merge fails to enforce update or select row security policies

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

CVSS 3.1 · 3.1 Low EPSS 1.1% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 3 more

CVE-2023-4273

Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 10 more

CVE-2023-4911

Glibc: buffer overflow in ld.so leading to privilege escalation

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVSS 3.1 · 7.8 High EPSS 63.8% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 49 more