Export limit exceeded: 12053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,053

Export CSV
CVE-2026-89792

ksmbd: prevent out-of-bounds reads in share config responses

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the path length.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-69562

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sql Server 2017 Sql Server 2019
CVE-2026-102757

ThreadX Module May Bypass MPU to Escalate Privileges Through Memory Manipulation

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx
CVE-2026-93270

bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-79896

Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager
CVE-2026-91817

Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Foxit Foxitsoftware
Products
Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more
CVE-2026-47513

nvidia-driver: nvidia-driver: arbitrary code execution via kernel heap out-of-bounds read

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-47524

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via out-of-bounds read

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-93281

wifi: rtw89: fix HE extended capability length check

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen >= 11 before reading data[10].

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-58160

Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-101204

FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Faststone
Products
Image Viewer
CVE-2026-97423

cxl/region: Validate partition index before array access

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-102717

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Netx Duo
CVE-2026-77219

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Emacs
CVE-2026-76641

Expat Out-of-Bounds Read via dtdCopy

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Libexpat Project
Products
Expat Libexpat
CVE-2026-56719

MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mikrotik
Products
Routeros
CVE-2026-102507

Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bishopfox
Products
Sliver
CVE-2026-47512

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via out-of-bounds read in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more