Export limit exceeded: 50830 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50830 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-49462 | 1 Nl-portal | 1 Nl.nl-portal:app | 2026-09-14 | 5.3 Medium |
| NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration. | ||||
| CVE-2026-54241 | 1 Struktur | 1 Libde265 | 2026-09-14 | 7.4 High |
| libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch. | ||||
| CVE-2026-90994 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-09-14 | 4 Medium |
| A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service. | ||||
| CVE-2026-81953 | 1 Microsoft | 14 365 Apps, Excel, Excel 2016 and 11 more | 2026-09-14 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-82076 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-09-14 | 6.5 Medium |
| An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node. | ||||
| CVE-2026-69738 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-14 | 7.8 High |
| Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69826 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-14 | 8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-77898 | 1 Microsoft | 16 365, 365 Apps, Microsoft 365 and 13 more | 2026-09-14 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69293 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-14 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-90794 | 1 Gpac | 1 Gpac | 2026-09-14 | 6.3 Medium |
| A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component. | ||||
| CVE-2026-90463 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-09-14 | 4 Medium |
| A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure. | ||||
| CVE-2026-90779 | 1 Sipp | 1 Sipp | 2026-09-14 | 7.5 High |
| SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process. | ||||
| CVE-2026-90715 | 1 Marcobambini | 1 Gravity | 2026-09-14 | 7.3 High |
| A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended. | ||||
| CVE-2026-90681 | 1 Matthias-wandel | 1 Jhead | 2026-09-14 | 3.3 Low |
| A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-90678 | 1 Haproxy | 1 Haproxy | 2026-09-14 | 7.5 High |
| An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected. | ||||
| CVE-2026-90607 | 1 Totolink | 1 A3002mu | 2026-09-14 | 9.9 Critical |
| A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used. | ||||
| CVE-2026-89094 | 1 Forgejo | 1 Forgejo | 2026-09-14 | 9.9 Critical |
| Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. | ||||
| CVE-2026-87736 | 1 Ocaml | 1 Mirage-crypto-ec | 2026-09-14 | 4.3 Medium |
| An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. | ||||
| CVE-2026-90686 | 1 Gpac | 1 Gpac | 2026-09-14 | 5.3 Medium |
| A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component. | ||||
| CVE-2026-79515 | 1 Nothings | 1 Stb | 2026-09-14 | 4.3 Medium |
| An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file. | ||||