Total
9704 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-9086 | 2 Debian, Haxx | 2 Debian Linux, Curl | 2026-09-14 | N/A | 7.5 HIGH |
| 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. | |||||
| CVE-2026-90716 | 2026-09-14 | 6.5 MEDIUM | 5.5 MEDIUM | ||
| A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component. | |||||
| CVE-2026-90681 | 2026-09-14 | 1.7 LOW | 3.3 LOW | ||
| A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-86714 | 2026-09-14 | N/A | 5.4 MEDIUM | ||
| PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files. | |||||
| CVE-2026-85698 | 2026-09-14 | N/A | 5.5 MEDIUM | ||
| Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files. | |||||
| CVE-2026-55093 | 2026-09-14 | N/A | 6.1 MEDIUM | ||
| Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1. | |||||
| CVE-2026-54542 | 2026-09-14 | N/A | 3.7 LOW | ||
| Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0. | |||||
| CVE-2026-69265 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 7.8 HIGH |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69312 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 7.8 HIGH |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69332 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 8.0 HIGH |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69340 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 7.1 HIGH |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-88048 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-09-14 | N/A | 7.1 HIGH |
| Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed release is available as of this review. | |||||
| CVE-2026-69504 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69505 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 8.0 HIGH |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69532 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 7.8 HIGH |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69591 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-14 | N/A | 5.7 MEDIUM |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-89156 | 2026-09-14 | N/A | 2.9 LOW | ||
| PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. | |||||
| CVE-2026-38332 | 2026-09-14 | N/A | 2.9 LOW | ||
| TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. | |||||
| CVE-2025-26790 | 2026-09-14 | N/A | 3.7 LOW | ||
| Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine. | |||||
| CVE-2026-90994 | 2026-09-14 | N/A | 4.0 MEDIUM | ||
| A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service. | |||||