Total
10514 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-82943 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory. | |||||
| CVE-2026-111269 | 2026-10-26 | N/A | 6.1 MEDIUM | ||
| libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory. | |||||
| CVE-2026-111159 | 2026-10-26 | N/A | 6.1 MEDIUM | ||
| libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes. | |||||
| CVE-2026-111149 | 2026-10-26 | N/A | 6.1 MEDIUM | ||
| FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process. | |||||
| CVE-2026-111139 | 2026-10-26 | N/A | 5.5 MEDIUM | ||
| NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode(). | |||||
| CVE-2026-111134 | 2026-10-26 | N/A | 6.1 MEDIUM | ||
| libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers. | |||||
| CVE-2026-107900 | 2026-10-26 | N/A | 7.8 HIGH | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | |||||
| CVE-2026-107899 | 2026-10-26 | N/A | 7.8 HIGH | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | |||||
| CVE-2026-107898 | 2026-10-26 | N/A | 7.8 HIGH | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | |||||
| CVE-2026-107897 | 2026-10-26 | N/A | 7.8 HIGH | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | |||||
| CVE-2026-107896 | 2026-10-26 | N/A | 7.8 HIGH | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | |||||
| CVE-2026-103569 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-26 | N/A | 7.5 HIGH |
| Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-105004 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-26 | N/A | 7.8 HIGH |
| Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-102225 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-26 | N/A | 8.8 HIGH |
| Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-111164 | 2026-10-26 | N/A | 5.5 MEDIUM | ||
| UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it. | |||||
| CVE-2026-43996 | 1 Openimageio | 1 Openimageio | 2026-10-26 | N/A | 5.5 MEDIUM |
| OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0. | |||||
| CVE-2026-43909 | 1 Openimageio | 1 Openimageio | 2026-10-26 | N/A | 8.8 HIGH |
| OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0. | |||||
| CVE-2026-42934 | 1 F5 | 7 Dos, Nginx Gateway Fabric, Nginx Ingress Controller and 4 more | 2026-10-26 | N/A | 4.8 MEDIUM |
| NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-8535 | 2 Google, Linux | 3 Chrome, Chrome Os, Linux Kernel | 2026-10-26 | N/A | 5.3 MEDIUM |
| Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file. (Chromium security severity: High) | |||||
| CVE-2026-8578 | 2 Google, Linux | 2 Chrome, Linux Kernel | 2026-10-26 | N/A | 3.1 LOW |
| Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||