Total
3693 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-69431 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 9.8 CRITICAL |
| Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69432 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Volume Manager Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-70583 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-28 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-57226 | 1 Oisf | 1 Suricata | 2026-09-28 | N/A | 3.7 LOW |
| Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17. | |||||
| CVE-2026-63451 | 1 Oisf | 1 Suricata | 2026-09-28 | N/A | 3.3 LOW |
| Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6. | |||||
| CVE-2026-62744 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-09-28 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69459 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-28 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69462 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 8.0 HIGH |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69468 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 7.0 HIGH |
| Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69478 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-28 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69480 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-28 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69481 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 8.0 HIGH |
| Heap-based buffer overflow in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69492 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 7.0 HIGH |
| Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69493 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 9.8 CRITICAL |
| Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69494 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 8.8 HIGH |
| Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69495 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-28 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-14673 | 1 Gmg137 | 1 Snap7-rs | 2026-09-28 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7_rs::client::S7Client::as_ct_write of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-14672 | 1 Gmg137 | 1 Snap7-rs | 2026-09-28 | 7.5 HIGH | 7.3 HIGH |
| A flaw has been found in gmg137 snap7-rs up to 1.142.1. This impacts the function TSnap7MicroClient::opWriteArea of the file s7_micro_client.cpp. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. | |||||
| CVE-2025-7983 | 1 Ashlar | 1 Graphite | 2026-09-26 | N/A | 7.8 HIGH |
| Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25477. | |||||
| CVE-2025-11788 | 1 Circutor | 4 Sge-plc1000, Sge-plc1000 Firmware, Sge-plc50 and 1 more | 2026-09-26 | N/A | 9.8 CRITICAL |
| Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf()'. The 'GetParameter(meter)' function retrieves the user input, which is directly incorporated into a buffer without size validation. An attacker can provide an excessively large input for the 'meter' parameter. | |||||