Export limit exceeded: 52752 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (52752 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-44236 | 1 Alanxz | 1 Rabbitmq-c | 2026-09-21 | 7.1 High |
| rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0. | ||||
| CVE-2026-94142 | 1 Biostar | 1 Temperature Monitor Utility | 2026-09-21 | 8.8 High |
| A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-94128 | 1 Biostar | 1 Vivid Led Dj | 2026-09-21 | 8.8 High |
| A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-94100 | 1 Netcore | 1 Nbr200v2 | 2026-09-21 | 9.9 Critical |
| A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-94090 | 1 Justicerage | 1 Manalyze | 2026-09-21 | 6.3 Medium |
| A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue. | ||||
| CVE-2026-91991 | 1 Tornadoweb | 1 Tornado | 2026-09-21 | 5.4 Medium |
| Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes. | ||||
| CVE-2026-69628 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-21 | 8.8 High |
| Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-72944 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-21 | 7.8 High |
| Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72942 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-21 | 6.5 Medium |
| Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-72962 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-21 | 8.2 High |
| Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72953 | 1 Microsoft | 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more | 2026-09-21 | 7.8 High |
| Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72947 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-09-21 | 6.4 Medium |
| Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72952 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-21 | 7 High |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. | ||||
| CVE-2026-62866 | 1 Tomwright | 1 Dasel | 2026-09-21 | 6.2 Medium |
| Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2. | ||||
| CVE-2026-72950 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-21 | 8.8 High |
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | ||||
| CVE-2026-72960 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-21 | 8.8 High |
| Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-93494 | 2 Io.netty, Redhat | 8 Netty-codec-http, Build Of Apache Camel For Spring Boot, Camel Spring Boot and 5 more | 2026-09-21 | 7.5 High |
| A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec. | ||||
| CVE-2026-93561 | 2 Io.netty, Redhat | 8 Netty-codec-http, Build Of Apache Camel For Spring Boot, Camel Spring Boot and 5 more | 2026-09-21 | 6.5 Medium |
| A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments. | ||||
| CVE-2026-93578 | 2 Io.netty, Redhat | 3 Netty-codec-http, Build Of Apache Camel For Spring Boot, Camel Spring Boot | 2026-09-21 | 5.9 Medium |
| A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass. | ||||
| CVE-2026-93563 | 2 Io.netty, Redhat | 8 Netty-codec-http, Build Of Apache Camel For Spring Boot, Camel Spring Boot and 5 more | 2026-09-21 | 7.5 High |
| A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash. | ||||