Export limit exceeded: 52967 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (52967 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111381 | 1 Freerdp | 1 Freerdp | 2026-10-16 | 7.3 High |
| FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded. | ||||
| CVE-2026-111380 | 1 Freerdp | 1 Freerdp | 2026-10-16 | 8.8 High |
| FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients. | ||||
| CVE-2026-111376 | 1 Freerdp | 1 Freerdp | 2026-10-16 | 5 Medium |
| FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size. | ||||
| CVE-2026-111375 | 1 Freerdp | 1 Freerdp | 2026-10-16 | 4.8 Medium |
| FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client. | ||||
| CVE-2026-110912 | 1 Dragonflybsd | 1 Dragonflybsd | 2026-10-16 | N/A |
| In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available. | ||||
| CVE-2026-84790 | 2026-10-16 | N/A | ||
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | ||||
| CVE-2026-88964 | 2026-10-16 | N/A | ||
| An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options | ||||
| CVE-2026-50216 | 2026-10-16 | 5.3 Medium | ||
| An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension. | ||||
| CVE-2026-110449 | 1 Nixos | 1 Nix | 2026-10-16 | 7.5 High |
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. | ||||
| CVE-2026-107153 | 2026-10-16 | N/A | ||
| Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. | ||||
| CVE-2026-108426 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108427 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108428 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108429 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108430 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108431 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108432 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108434 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108436 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108437 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||