Total
3693 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-46572 | 1 Tuxera | 1 Ntfs-3g | 2026-10-08 | N/A | 7.4 HIGH |
| In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory. | |||||
| CVE-2026-46570 | 1 Tuxera | 1 Ntfs-3g | 2026-10-08 | N/A | 8.1 HIGH |
| In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata. | |||||
| CVE-2025-11495 | 1 Gnu | 1 Binutils | 2026-10-08 | 1.7 LOW | 3.3 LOW |
| A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch. | |||||
| CVE-2025-20720 | 2 Mediatek, Openwrt | 10 Mt6890, Mt7603, Mt7615 and 7 more | 2026-10-08 | N/A | 8.8 HIGH |
| In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569. | |||||
| CVE-2025-54282 | 2 Adobe, Microsoft | 2 Framemaker, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2025-20712 | 2 Mediatek, Openwrt | 7 Mt6990, Mt7990, Mt7991 and 4 more | 2026-10-08 | N/A | 8.8 HIGH |
| In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810. | |||||
| CVE-2025-54278 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-10-08 | N/A | 5.5 MEDIUM |
| Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2025-61804 | 3 Adobe, Apple, Microsoft | 3 Animate, Macos, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Animate versions 23.0.13, 24.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2025-54268 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2025-11464 | 1 Ashlar | 1 Cobalt | 2026-10-08 | N/A | 7.8 HIGH |
| Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26628. | |||||
| CVE-2025-62608 | 1 Ml-explore | 1 Mlx | 2026-10-08 | N/A | 9.1 CRITICAL |
| MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4. | |||||
| CVE-2026-95387 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 8.1 HIGH |
| SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-95388 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 5.5 MEDIUM |
| Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-95389 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 8.1 HIGH |
| SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-95393 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 4.7 MEDIUM |
| CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2021-45949 | 2 Artifex, Debian | 2 Ghostscript, Debian Linux | 2026-10-08 | 4.3 MEDIUM | 5.5 MEDIUM |
| Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). | |||||
| CVE-2026-96417 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 5.5 MEDIUM |
| RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-96416 | 1 Wireshark | 1 Wireshark | 2026-10-08 | N/A | 5.5 MEDIUM |
| IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2025-62689 | 1 Gnu | 1 Libmicrohttpd | 2026-10-08 | N/A | 7.5 HIGH |
| NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition. | |||||
| CVE-2025-11206 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-07 | N/A | 7.1 HIGH |
| Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||