Total
3159 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-54001 | 2026-07-14 | N/A | N/A | ||
| osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to publisher information parsing in getOriginalProgramName. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1. | |||||
| CVE-2026-54000 | 2026-07-14 | N/A | N/A | ||
| osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the processes table targeting a maliciously crafted process, due to unchecked PEB string lengths in process command-line and current-directory reads. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1. | |||||
| CVE-2026-56372 | 1 Imagemagick | 1 Imagemagick | 2026-07-13 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service. | |||||
| CVE-2026-15520 | 2026-07-13 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. You should upgrade the affected component. | |||||
| CVE-2026-56002 | 1 X | 1 Libxfont | 2026-07-13 | N/A | 8.5 HIGH |
| A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server. | |||||
| CVE-2026-58379 | 2026-07-13 | N/A | 7.3 HIGH | ||
| A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory. | |||||
| CVE-2026-15165 | 1 Wireshark | 1 Wireshark | 2026-07-10 | N/A | 5.5 MEDIUM |
| TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | |||||
| CVE-2026-15164 | 1 Wireshark | 1 Wireshark | 2026-07-10 | N/A | 5.5 MEDIUM |
| Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-15123 | 1 Google | 1 Chrome | 2026-07-10 | N/A | 8.8 HIGH |
| Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-14940 | 1 Redhat | 3 389 Directory Server, Directory Server, Enterprise Linux | 2026-07-09 | N/A | 5.3 MEDIUM |
| A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service. | |||||
| CVE-2026-15169 | 1 Wireshark | 1 Wireshark | 2026-07-09 | N/A | 5.5 MEDIUM |
| UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-56003 | 1 X | 1 Libxfont | 2026-07-09 | N/A | 8.5 HIGH |
| A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server. | |||||
| CVE-2026-55999 | 1 X.org | 2 X Server, Xwayland | 2026-07-09 | N/A | 8.5 HIGH |
| Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks. | |||||
| CVE-2026-56001 | 1 X | 1 Libxfont | 2026-07-09 | N/A | 8.5 HIGH |
| A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont | |||||
| CVE-2026-15170 | 1 Wireshark | 1 Wireshark | 2026-07-09 | N/A | 5.5 MEDIUM |
| Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-15173 | 1 Wireshark | 1 Wireshark | 2026-07-09 | N/A | 4.7 MEDIUM |
| pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | |||||
| CVE-2026-15174 | 1 Wireshark | 1 Wireshark | 2026-07-09 | N/A | 5.5 MEDIUM |
| Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | |||||
| CVE-2026-15182 | 2026-07-09 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component. | |||||
| CVE-2026-58306 | 2026-07-09 | N/A | 6.1 MEDIUM | ||
| Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98. | |||||
| CVE-2026-58471 | 1 Gnu | 1 Wget | 2026-07-09 | N/A | 5.9 MEDIUM |
| GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response. | |||||