Export limit exceeded: 16458 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16458 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118375 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-11-03 | 8.1 High |
| llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code. | ||||
| CVE-2026-20433 | 1 Mediatek | 125 Mediatek Chipset, Mt2735, Mt2735 Firmware and 122 more | 2026-11-03 | 8 High |
| In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460. | ||||
| CVE-2026-20566 | 2 Mediatek, Mediatek, Inc. | 2 Mediatek Chipset, Mediatek Chipset | 2026-11-03 | 4.8 Medium |
| In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: MOLY01923663 / ALPS11315955; Issue ID: MSV-10866. | ||||
| CVE-2026-120064 | 1 Postgresql | 1 Psqlodbc | 2026-11-03 | 7.5 High |
| Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected. | ||||
| CVE-2026-118753 | 2 Danoli3, Freeimage Project | 2 Freeimage, Freeimage | 2026-11-03 | 7.8 High |
| FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK. | ||||
| CVE-2026-112510 | 1 Apple | 1 Macos | 2026-11-02 | 7.5 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service. | ||||
| CVE-2026-113950 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-02 | 5.4 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory. | ||||
| CVE-2026-104067 | 1 Scribus | 1 Scribus | 2026-11-02 | 7.8 High |
| Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user. | ||||
| CVE-2026-104062 | 1 Scribus | 1 Scribus | 2026-11-02 | 7.8 High |
| Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user. | ||||
| CVE-2026-120061 | 1 Postgresql | 1 Psqlodbc | 2026-11-02 | 7.5 High |
| The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected. | ||||
| CVE-2023-41140 | 1 Autodesk | 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more | 2026-11-02 | 7.8 High |
| A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | ||||
| CVE-2023-29074 | 1 Autodesk | 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more | 2026-11-02 | 9.8 Critical |
| A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | ||||
| CVE-2023-29073 | 1 Autodesk | 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more | 2026-11-02 | 9.8 Critical |
| A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | ||||
| CVE-2022-38533 | 2 Fedoraproject, Gnu | 2 Fedora, Binutils | 2026-11-02 | 5.5 Medium |
| In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. | ||||
| CVE-2022-36280 | 3 Debian, Linux, Redhat | 3 Debian Linux, Linux Kernel, Enterprise Linux | 2026-11-02 | 6.3 Medium |
| An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). | ||||
| CVE-2026-104066 | 1 Scribus | 1 Scribus | 2026-11-02 | 7.8 High |
| Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution. | ||||
| CVE-2022-3234 | 3 Debian, Fedoraproject, Vim | 3 Debian Linux, Fedora, Vim | 2026-11-02 | 7.8 High |
| Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. | ||||
| CVE-2026-120067 | 1 Postgresql | 1 Psqlodbc | 2026-11-02 | 5.9 Medium |
| For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected. | ||||
| CVE-2026-58458 | 1 Klei Entertainment | 1 Don't Starve Together | 2026-11-02 | 6.5 Medium |
| Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service. | ||||
| CVE-2026-69705 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 9.8 Critical |
| Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | ||||