Export limit exceeded: 10085 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11855 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11855 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112479 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-03 | 5.2 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-57192 | 1 Asterisk | 2 Asterisk, Certified Asterisk | 2026-11-03 | 6.5 Medium |
| Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | ||||
| CVE-2026-117608 | 1 Assimp | 1 Assimp | 2026-11-03 | 6.1 Medium |
| Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory. | ||||
| CVE-2026-20518 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-11-03 | 4.2 Medium |
| In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10867524 / ALPS10876355; Issue ID: MSV-6674. | ||||
| CVE-2026-113935 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-113938 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-112642 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-03 | 6.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory. | ||||
| CVE-2026-104063 | 1 Scribus | 1 Scribus | 2026-11-02 | 6.1 Medium |
| Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure. | ||||
| CVE-2023-4693 | 2 Gnu, Redhat | 2 Grub2, Enterprise Linux | 2026-11-02 | 5.3 Medium |
| An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. | ||||
| CVE-2023-1916 | 1 Libtiff | 1 Libtiff | 2026-11-02 | 6.1 Medium |
| A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. | ||||
| CVE-2022-2905 | 3 Debian, Linux, Redhat | 3 Debian Linux, Linux Kernel, Enterprise Linux | 2026-11-02 | 5.5 Medium |
| An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. | ||||
| CVE-2026-69867 | 2 Microsoft, Sqlite | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-11-02 | 7.8 High |
| Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69721 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 5.5 Medium |
| Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69675 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-11-02 | 5.5 Medium |
| Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-120060 | 1 Postgresql | 1 Psqlodbc | 2026-11-02 | 5.9 Medium |
| psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected. | ||||
| CVE-2026-58496 | 1 Thorvg | 1 Thorvg | 2026-11-02 | 4.3 Medium |
| Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7. | ||||
| CVE-2026-117555 | 2 Cimg, Greyclab | 2 Cimg, Cimg | 2026-11-02 | 6.1 Medium |
| CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image. | ||||
| CVE-2026-116733 | 1 Flatcc Project | 1 Flatcc | 2026-11-02 | 3.7 Low |
| flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page. | ||||
| CVE-2026-116729 | 1 Libyal | 1 Libfvde | 2026-11-02 | 3.3 Low |
| libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer. | ||||
| CVE-2026-116725 | 1 Mmitch | 1 Gbsplay | 2026-11-02 | 5.5 Medium |
| gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player. | ||||