Export limit exceeded: 29219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29219 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90832 | 2026-11-10 | 4.3 Medium | ||
| bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload. The Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends. Exploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync. The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers. | ||||
| CVE-2026-68798 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68807 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68800 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-62877 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 7.8 High |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-121032 | 1 Google | 1 Chrome | 2026-11-10 | 7.4 High |
| Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121197 | 2 Apple, Google | 2 Macos, Chrome | 2026-11-10 | 7.4 High |
| Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-67645 | 1 Microsoft | 11 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 8 more | 2026-11-10 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-73013 | 1 Microsoft | 27 Office, Windows 10 1607, Windows 10 1809 and 24 more | 2026-11-10 | 8.8 High |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69610 | 1 Microsoft | 29 Office 365, Office Macos 2021, Office Macos 2024 and 26 more | 2026-11-10 | 7 High |
| Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69592 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68880 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 8 High |
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69609 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 5.5 Medium |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-68781 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-11-10 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-125343 | 2026-11-10 | 8.3 High | ||
| Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-126129 | 2026-11-10 | N/A | ||
| The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints. | ||||
| CVE-2026-113575 | 2026-11-10 | 7.8 High | ||
| Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-118199 | 2026-11-10 | 5.5 Medium | ||
| Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-116480 | 2026-11-10 | 7.8 High | ||
| Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-118200 | 2026-11-10 | 5.5 Medium | ||
| Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||