Total
3693 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-15165 | 1 Wireshark | 1 Wireshark | 2026-10-25 | N/A | 5.5 MEDIUM |
| TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | |||||
| CVE-2026-54696 | 2026-10-25 | N/A | 3.7 LOW | ||
| Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9. | |||||
| CVE-2026-54896 | 2026-10-25 | N/A | N/A | ||
| Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory. This issue has been fixed in version 3.17.2. | |||||
| CVE-2026-15164 | 1 Wireshark | 1 Wireshark | 2026-10-25 | N/A | 5.5 MEDIUM |
| Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-15123 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 8.8 HIGH |
| Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-20462 | 2026-10-25 | N/A | 6.7 MEDIUM | ||
| In Telephony, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11006447; Issue ID: MSV-7871. | |||||
| CVE-2026-15169 | 1 Wireshark | 1 Wireshark | 2026-10-25 | N/A | 5.5 MEDIUM |
| UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-15182 | 2026-10-25 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component. | |||||
| CVE-2026-15173 | 1 Wireshark | 1 Wireshark | 2026-10-25 | N/A | 4.7 MEDIUM |
| pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | |||||
| CVE-2026-15170 | 1 Wireshark | 1 Wireshark | 2026-10-25 | N/A | 5.5 MEDIUM |
| Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-14385 | 2 Apple, Google | 2 Macos, Chrome | 2026-10-25 | N/A | 8.8 HIGH |
| Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-14415 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 8.8 HIGH |
| Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-14610 | 2026-10-25 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. Patch name: eb84eec580d3f4ba2f0fd87409b7d0744620f11e. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-56372 | 1 Imagemagick | 1 Imagemagick | 2026-10-25 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service. | |||||
| CVE-2026-56645 | 1 Microsoft | 1 Edge Chromium | 2026-10-25 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-14759 | 1 Radare | 1 Radare2 | 2026-10-25 | 1.7 LOW | 3.3 LOW |
| A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch. | |||||
| CVE-2026-15520 | 2026-10-24 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. You should upgrade the affected component. | |||||
| CVE-2026-15506 | 2026-10-24 | 6.8 MEDIUM | 7.8 HIGH | ||
| A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver. Such manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 10.10.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-48339 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-10-24 | N/A | 7.8 HIGH |
| Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-48269 | 1 Adobe | 1 Premiere Pro | 2026-10-24 | N/A | 7.8 HIGH |
| Premiere Pro is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||