[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108433 | 15 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseReliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2026-108434 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108435 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseUntrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108426 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108427 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105035 | 15 Oct 2026 | CVSS 7.8 | EnergizeLab FirmwareUpdaterThe EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An… | |
| CVE-2026-105036 | 15 Oct 2026 | CVSS 7.5 | EnergizeLab Robot firmware (mode 104000)EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download… | |
| CVE-2026-105037 | 15 Oct 2026 | CVSS 9.9 | EnergizeLab station-middlewareEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from… | |
| CVE-2026-105038 | 15 Oct 2026 | CVSS 9.8 | EnergizeLab FastAPI AI inference serverThe EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An… | |
| CVE-2026-105039 | 15 Oct 2026 | CVSS 9.6 | EnergizeLab station-middlewareEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated… | |
| CVE-2026-105040 | 15 Oct 2026 | CVSS 8.8 | EnergizeLab NestJS auth serviceThe EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set… | |
| CVE-2026-105032 | 15 Oct 2026 | CVSS 9.1 | EnergizeLab FastAPI AI inference serverThe EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication… | |
| CVE-2026-105033 | 15 Oct 2026 | CVSS 8.8 | EnergizeLab AI Station firmware (RK3562)The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device… | |
| CVE-2026-105034 | 15 Oct 2026 | CVSS 8.2 | EnergizeLab NestJS auth serviceThe EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote… | |
| CVE-2026-102764 | 15 Oct 2026 | CVSS 9.8 | Authentication bypass in BeyondTrust Remote SupportThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of… | Exploited |
| CVE-2026-104198 | 15 Oct 2026 | CVSS 5.3 | zoneminderZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles… | |
| CVE-2026-106700 | 15 Oct 2026 | CVSS 8.8 | VulnerabilityELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of… | |
| CVE-2026-106708 | 15 Oct 2026 | CVSS 8.8 | VulnerabilityXXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController)… | |
| CVE-2026-94621 | 15 Oct 2026 | CVSS 6.3 | aliasvaultAliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a… | |
| CVE-2026-96449 | 15 Oct 2026 | CVSS 5.3 | WPExperts WP EasyPayMissing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-97370 | 15 Oct 2026 | CVSS 7.5 | Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extractionJunrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can… | Fix |
| CVE-2026-92707 | 15 Oct 2026 | CVSS 5.3 | MessagePack: Nested arrays can blow past buffer length limitsMessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as… | Fix |
| CVE-2026-87029 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards… | |
| CVE-2026-87018 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process… | |
| CVE-2026-62322 | 15 Oct 2026 | CVSS 6.5 | Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without… | Fix |
| CVE-2026-63430 | 15 Oct 2026 | CVSS 6.3 | ammonia: mXSS via MathML `annotation-xml` encoding stripammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math… | Fix |
| CVE-2026-55871 | 15 Oct 2026 | CVSS 6.5 | mayerbalintdev GYM-OneGYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's… | |
| CVE-2026-55872 | 15 Oct 2026 | CVSS 8.7 | mayerbalintdev GYM-OneGYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's… | |
| CVE-2026-57183 | 15 Oct 2026 | CVSS 6.1 | Erudika scooldScoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in… | |
| CVE-2026-57496 | 15 Oct 2026 | CVSS 9.6 | Labs64 NetLicensing-MCPNetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64… | |
| CVE-2026-55239 | 15 Oct 2026 | CVSS 8.8 | msgbyte tianjiTianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in… | |
| CVE-2026-55240 | 15 Oct 2026 | CVSS 9.1 | msgbyte tianjiTianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts… | |
| CVE-2026-55587 | 15 Oct 2026 | CVSS 8.1 | aliasvaultAliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does… | |
| CVE-2026-55840 | 15 Oct 2026 | CVSS 5.4 | Erudika scooldScoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in… | |
| CVE-2026-55842 | 15 Oct 2026 | CVSS 5.4 | Erudika scooldScoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in… | |
| CVE-2026-47218 | 15 Oct 2026 | CVSS 9.3 | containerd runwasirunwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled… | |
| CVE-2026-36436 | 15 Oct 2026 | CVSS 7.5 | VulnerabilityAn issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An… | |
| CVE-2026-45165 | 15 Oct 2026 | CVSS 8.6 | Palo Alto Networks Idira Secrets Manager (Self-Hosted)An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy… | |
| CVE-2026-111231 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because… | |
| CVE-2026-111232 | 15 Oct 2026 | CVSS 4.8 | Netgate pfSense CENetgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or… | |
| CVE-2026-111233 | 15 Oct 2026 | CVSS 6.1 | Netgate pfSense CENetgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to… | |
| CVE-2026-111234 | 15 Oct 2026 | CVSS 5.9 | simplepieSimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in… | |
| CVE-2026-111235 | 15 Oct 2026 | CVSS 9.1 | The OpenNMS Group MeridianAn authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security… | |
| CVE-2026-111252 | 15 Oct 2026 | CVSS 6.5 | The OpenNMS Group MeridianA denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an… | |
| CVE-2026-111224 | 15 Oct 2026 | CVSS 7.5 | Netgate pfSense CEpfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN… | |
| CVE-2026-111225 | 15 Oct 2026 | CVSS 8.8 | Netgate pfSense CENetgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN… | |
| CVE-2026-111226 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access… | |
| CVE-2026-111227 | 15 Oct 2026 | CVSS 5.5 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS… | |
| CVE-2026-111228 | 15 Oct 2026 | CVSS 5.5 | Netgate pfSense CENetgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users… | |
| CVE-2026-111229 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the… | |
| CVE-2026-111230 | 15 Oct 2026 | CVSS 4.9 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as… | |
| CVE-2026-111217 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to… | |
| CVE-2026-111218 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters… | |
| CVE-2026-111219 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject… | |
| CVE-2026-111220 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands… | |
| CVE-2026-111221 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by… | |
| CVE-2026-111222 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject… | |
| CVE-2026-111223 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges… | Fix |
| CVE-2026-111170 | 15 Oct 2026 | CVSS 6.5 | kedro-org kedro-datasetskedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files… | |
| CVE-2026-111171 | 15 Oct 2026 | CVSS 5.4 | ethereum web3.pyWeb3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not… | |
| CVE-2026-111172 | 15 Oct 2026 | CVSS 5.3 | stalniy @casl/ability@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins… | |
| CVE-2026-111214 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run… | |
| CVE-2026-111215 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by… | |
| CVE-2026-111216 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to… | |
| CVE-2026-111165 | 15 Oct 2026 | CVSS 5.5 | sezero libmikmodlibmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is… | |
| CVE-2026-111166 | 15 Oct 2026 | CVSS 5.5 | sezero libmikmodlibmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated… | |
| CVE-2026-111167 | 15 Oct 2026 | CVSS 6.1 | GNU LibreDWGGNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read… | |
| CVE-2026-111168 | 15 Oct 2026 | CVSS 5.4 | abhinavxd libredeskLibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs… | |
| CVE-2026-111169 | 15 Oct 2026 | CVSS 3.1 | suitenumerique docsLa Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of… | |
| CVE-2026-111160 | 15 Oct 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying… | |
| CVE-2026-111161 | 15 Oct 2026 | CVSS 6.1 | Wohlstand libADLMIDIlibADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt… | |
| CVE-2026-111162 | 15 Oct 2026 | CVSS 6.1 | Mindwerks WildMIDIWildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond… | |
| CVE-2026-111163 | 15 Oct 2026 | CVSS 5.5 | Mindwerks WildMIDIWildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling… | |
| CVE-2026-111164 | 15 Oct 2026 | CVSS 5.5 | uadeUADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping… | |
| CVE-2026-111153 | 15 Oct 2026 | CVSS 5.5 | libgme game-music-emuGame Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash… | |
| CVE-2026-111154 | 15 Oct 2026 | CVSS 6.1 | sezero libtimiditylibTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory… | |
| CVE-2026-111155 | 15 Oct 2026 | CVSS 6.1 | sezero libtimiditylibTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId… | |
| CVE-2026-111156 | 15 Oct 2026 | CVSS 6.1 | sezero libtimiditylibTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory… | |
| CVE-2026-111157 | 15 Oct 2026 | CVSS 6.1 | soxSoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd… | |
| CVE-2026-111158 | 15 Oct 2026 | CVSS 5.5 | EarthScope libmseedEarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED… | |
| CVE-2026-111159 | 15 Oct 2026 | CVSS 6.1 | libyal libewflibewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value… | |
| CVE-2026-111146 | 15 Oct 2026 | CVSS 6.1 | Yeraze ytnefytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying… | |
| CVE-2026-111147 | 15 Oct 2026 | CVSS 6.1 | libyal libesedbLibyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read… | |
| CVE-2026-111148 | 15 Oct 2026 | CVSS 5.5 | libsidplayfplibsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file… | |
| CVE-2026-111149 | 15 Oct 2026 | CVSS 6.1 | danoli3 FreeImageFreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is… | |
| CVE-2026-111150 | 15 Oct 2026 | CVSS 5.5 | ValleyBell libvgmValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded… | |
| CVE-2026-111151 | 15 Oct 2026 | CVSS 6.1 | aous72 OpenJPHOpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory… | |
| CVE-2026-111152 | 15 Oct 2026 | CVSS 5.5 | libgme game-music-emuGame Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer… | |
| CVE-2026-111140 | 15 Oct 2026 | CVSS 6.1 | libyal libregflibregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without… | |
| CVE-2026-111141 | 15 Oct 2026 | CVSS 4.7 | gdraheim zziplibzziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read… | |
| CVE-2026-111142 | 15 Oct 2026 | CVSS 5.5 | gdraheim zziplibZziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted… | |
| CVE-2026-111143 | 15 Oct 2026 | CVSS 5.5 | ansilove libansiloveAnsilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for… | |
| CVE-2026-111144 | 15 Oct 2026 | CVSS 5.5 | ansilove libansilovelibansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by… | |
| CVE-2026-111145 | 15 Oct 2026 | CVSS 6.1 | Yeraze ytnefytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for… | |
| CVE-2026-111134 | 15 Oct 2026 | CVSS 6.1 | libyal libfwsilibfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read… | |
| CVE-2026-111135 | 15 Oct 2026 | CVSS 6.1 | libyal libfwsilibfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past… | |
| CVE-2026-111136 | 15 Oct 2026 | CVSS 6.1 | swami libinstpatchlibInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not… | |
| CVE-2026-111137 | 15 Oct 2026 | CVSS 6.1 | amartin755 libsmilibsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed… | |
| CVE-2026-111138 | 15 Oct 2026 | CVSS 5.5 | NetSurf libnsbmpNetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound… | |
| CVE-2026-111139 | 15 Oct 2026 | CVSS 5.5 | NetSurf libnsbmpNetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the… |
Page 47 of 168