Total
10514 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-83651 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-31 | N/A | 6.5 MEDIUM |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-70211 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-31 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-104029 | 2 Fedoraproject, Redhat | 3 Sssd, Enterprise Linux, Openshift Container Platform | 2026-10-31 | N/A | 3.3 LOW |
| A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS). | |||||
| CVE-2026-116744 | 2026-10-31 | N/A | 5.3 MEDIUM | ||
| ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer. | |||||
| CVE-2026-116736 | 2026-10-31 | N/A | 6.1 MEDIUM | ||
| Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash. | |||||
| CVE-2026-116732 | 2026-10-31 | N/A | 4.4 MEDIUM | ||
| libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers. | |||||
| CVE-2026-116728 | 2026-10-31 | N/A | 5.5 MEDIUM | ||
| libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application. | |||||
| CVE-2026-88158 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-31 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-77911 | 1 Microsoft | 6 365 Apps, Microsoft 365, Office 2019 and 3 more | 2026-10-30 | N/A | 6.5 MEDIUM |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-77491 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-30 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | |||||
| CVE-2026-69609 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-30 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-62958 | 2026-10-30 | N/A | 7.9 HIGH | ||
| libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18. | |||||
| CVE-2026-119338 | 2026-10-30 | N/A | N/A | ||
| Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4. | |||||
| CVE-2026-88086 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. | |||||
| CVE-2026-88081 | 2026-10-30 | N/A | 7.7 HIGH | ||
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-86954 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination. | |||||
| CVE-2026-61627 | 2026-10-30 | N/A | N/A | ||
| libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5. | |||||
| CVE-2026-119299 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2. | |||||
| CVE-2026-118769 | 2026-10-30 | N/A | N/A | ||
| Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0. | |||||
| CVE-2026-104063 | 2026-10-30 | N/A | 6.1 MEDIUM | ||
| Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure. | |||||