Export limit exceeded: 10961 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 12034 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12034 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81334 | 1 Hank-ai | 1 Darknet | 2026-09-24 | 6.1 Medium |
| darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file. | ||||
| CVE-2026-70579 | 1 Microsoft | 12 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 9 more | 2026-09-24 | 7.5 High |
| Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-70574 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 7.8 High |
| Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69427 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 8 High |
| Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69561 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 7.8 High |
| Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69538 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 7.8 High |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. | ||||
| CVE-2022-3256 | 4 Debian, Fedoraproject, Neovim and 1 more | 4 Debian Linux, Fedora, Neovim and 1 more | 2026-09-24 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0530. | ||||
| CVE-2022-3296 | 3 Fedoraproject, Neovim, Vim | 3 Fedora, Neovim, Vim | 2026-09-24 | 7.8 High |
| Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. | ||||
| CVE-2023-0049 | 5 Apple, Fedoraproject, Neovim and 2 more | 5 Macos, Fedora, Neovim and 2 more | 2026-09-24 | 7.8 High |
| Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. | ||||
| CVE-2022-3297 | 3 Fedoraproject, Neovim, Vim | 3 Fedora, Neovim, Vim | 2026-09-24 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0579. | ||||
| CVE-2026-81645 | 1 Huawei | 1 Harmonyos | 2026-09-24 | 5.9 Medium |
| Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-55648 | 1 Freerdp | 1 Freerdp | 2026-09-24 | 7.5 High |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0. | ||||
| CVE-2026-69324 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 7.8 High |
| Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69334 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-24 | 8.8 High |
| Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69373 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-24 | 6.7 Medium |
| Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-92239 | 1 Mozilla | 1 Thunderbird | 2026-09-24 | 8.1 High |
| A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92240 | 1 Mozilla | 1 Thunderbird | 2026-09-24 | 9.1 Critical |
| A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-88841 | 1 Busybox | 1 Busybox | 2026-09-24 | 3.3 Low |
| BusyBox dpkg write_status_file() does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages. | ||||
| CVE-2026-17701 | 2 Apple, Google | 2 Macos, Chrome | 2026-09-24 | 9.6 Critical |
| Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-88015 | 1 Rclone | 1 Rclone | 2026-09-23 | 5.3 Medium |
| rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1. | ||||