Export limit exceeded: 51107 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Search Results (51107 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-58095 1 Freebsd 1 Freebsd 2026-09-10 8.8 High
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.
CVE-2026-58096 1 Freebsd 1 Freebsd 2026-09-10 8.8 High
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.
CVE-2026-58097 1 Freebsd 1 Freebsd 2026-09-10 7.8 High
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
CVE-2026-86742 1 Snipeitapp 1 Snipe-it 2026-09-10 6.5 Medium
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config('app.escape_formulas') setting. An authenticated low-privilege user with ordinary create/edit rights on any record whose free-text fields appear in the report (asset name/tag, company name, category, model, or assignee display name) can set such a field to a value beginning with =, +, -, @, tab, or CR. When a user with reports.view privileges requests the export (POST /reports/unaccepted_assets) for a pending checkout acceptance referencing the poisoned record and opens the resulting CSV in Excel, LibreOffice Calc, or Google Sheets, the injected content is evaluated as a formula in the downloader's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on legacy Windows Excel configurations, DDE command execution. Fixed in 8.7.0.
CVE-2026-86199 1 Pmmp 1 Pocketmine-mp 2026-09-10 7.5 High
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
CVE-2026-80082 1 Microsoft 15 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 12 more 2026-09-10 6.5 Medium
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
CVE-2026-80084 1 Microsoft 5 365 Apps, Office 2016, Office 2019 and 2 more 2026-09-10 6.5 Medium
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
CVE-2026-47889 2 Spring, Vmware 2 Spring Framework, Spring Framework 2026-09-10 7.5 High
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
CVE-2026-80086 1 Microsoft 8 365 Apps, Microsoft 365, Office 2019 and 5 more 2026-09-10 6.5 Medium
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-80089 1 Microsoft 9 365 Apps, Microsoft 365, Office 2016 and 6 more 2026-09-10 6.5 Medium
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
CVE-2026-59692 2 Gstreamer, Redhat 9 Gstreamer, Enterprise Linux, Enterprise Linux Eus and 6 more 2026-09-10 7.5 High
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
CVE-2026-69778 1 Microsoft 8 365 Apps, Access, Access 2016 and 5 more 2026-09-10 8.8 High
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVE-2026-69529 1 Microsoft 7 365 Apps, Access, Access 2016 and 4 more 2026-09-10 8.8 High
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVE-2026-69477 1 Microsoft 7 365 Apps, Access, Access 2016 and 4 more 2026-09-10 7.3 High
Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally.
CVE-2023-54390 1 Pmmp 1 Pocketmine-mp 2026-09-10 7.5 High
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
CVE-2026-22590 1 Eprosima 1 Fast Dds 2026-09-10 9.1 Critical
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length >= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.
CVE-2026-87931 1 Behavioral Technology Group 1 Pavlok Behavioral Conditioning Wearable 2026-09-10 9.6 Critical
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-87911 1 Aws 1 Aws Labs Postgres Mcp Server 2026-09-10 9.6 Critical
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode. To remediate this issue, users should upgrade to version 1.1.7 or later.
CVE-2026-68897 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-10 7 High
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
CVE-2026-68892 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-10 7.8 High
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.