Export limit exceeded: 53869 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (53869 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89319 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error. | ||||
| CVE-2026-106676 | 2026-10-26 | N/A | ||
| qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders. | ||||
| CVE-2026-115679 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 6.5 Medium |
| Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer | ||||
| CVE-2026-115680 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 6.5 Medium |
| Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission | ||||
| CVE-2026-115919 | 1 Onnx | 1 Onnx | 2026-10-26 | 6.2 Medium |
| Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0. | ||||
| CVE-2026-115921 | 1 Onnx | 1 Onnx | 2026-10-26 | 6.2 Medium |
| Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0. | ||||
| CVE-2026-116013 | 1 Openresty | 1 Lua-resty-dns | 2026-10-26 | 3.7 Low |
| OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution. | ||||
| CVE-2026-107894 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107896 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107897 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107898 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107899 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107900 | 1 Fujielectric | 1 V-sft | 2026-10-26 | 7.8 High |
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-110475 | 1 Creditnirvana | 2 Creditnirvana Collections Platform (collectionworkz), Creditnirvana Collections Platform Collectionworkz | 2026-10-26 | N/A |
| This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user. | ||||
| CVE-2026-116487 | 1 Nxp | 1 Mcuxsdk-middleware-usb | 2026-10-26 | 4.6 Medium |
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory. | ||||
| CVE-2026-116488 | 1 Nxp | 1 Mcuxsdk-middleware-usb | 2026-10-26 | 6.8 Medium |
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service. | ||||
| CVE-2026-116542 | 1 Netty | 2 Netty-tcnative, Netty-tcnative-boringssl-static | 2026-10-26 | 5.3 Medium |
| Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging. | ||||
| CVE-2026-112346 | 1 Openhands | 1 Openhands Software Agent Sdk | 2026-10-26 | 9.8 Critical |
| OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store. | ||||
| CVE-2026-115678 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 5.3 Medium |
| Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing | ||||
| CVE-2026-115906 | 1 Zip-rs | 1 Zip2 | 2026-10-26 | 6.5 Medium |
| zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0. | ||||