CVE-2026-47501

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Privilege escalation via out-of-bounds write during event buffer setup

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Guest Driver Nvs and 4 more

CVE-2026-47498

Out-of-Bounds Write in NVIDIA Virtual GPU Manager GSP Plugin Leading to Possible Code Execution

NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Virtual Gpu Manager

CVE-2026-47548

nvidia-driver: nvidia-driver: Arbitrary code execution via out-of-bounds write in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Nvs Quadro and 3 more

CVE-2026-47575

Local Integer Overflow in NVIDIA Windows Driver Enables Code Execution and Denial of Service

NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attacker may cause an integer overflow and out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, and code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Nvs Quadro and 2 more

CVE-2026-100888

Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Trusted Domain Project

Products

Opendkim

CVE-2026-47582

nvidia-driver: nvidia-driver: Code execution via out-of-bounds write in kernel module

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Guest Driver Nvs and 4 more

CVE-2026-47556

nvidia-driver: nvidia-driver: arbitrary code execution via kernel-mode integer overflow

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Guest Driver Nvs and 3 more

CVE-2026-47561

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Guest Driver Nvs and 4 more

CVE-2026-76723

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS

Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Instant On

CVE-2026-76721

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Instant On

CVE-2026-102761

NetX Duo WebSocket Client Buffer Overwrite via Masking Key

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Netx Duo

CVE-2026-47565

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via kernel mode race condition

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race condition that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Geforce Guest Driver Nvs and 3 more

CVE-2026-15390

Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Denx Software Engineering

Products

Das U-boot

CVE-2026-102566

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Opennmt

Products

Ctranslate2

CVE-2026-63209

Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Klauspost

Products

Compress

CVE-2026-102729

Buffer Overflow in GUIX Theme Loader

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Guix

CVE-2026-92867

pgpool-II: Pgpool-II: arbitrary code execution via out-of-bounds write

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92869

pgpool-II: pgpool-II: Denial of Service via out-of-bounds write

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92870

pgpool-II: pgpool-II: Denial of Service via stack-based buffer overflow

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-74225

U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Denx U-boot

Products

U-boot U-boot