Total
580 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-108454 | 1 Microsoft | 4 365 Apps, Microsoft 365, Office 2021 and 1 more | 2026-10-19 | N/A | 6.5 MEDIUM |
| Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-46149 | 1 Linux | 1 Linux Kernel | 2026-10-19 | N/A | 7.1 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here. | |||||
| CVE-2026-45843 | 1 Linux | 1 Linux Kernel | 2026-10-19 | N/A | 8.2 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to. | |||||
| CVE-2026-46471 | 2026-10-19 | N/A | 5.5 MEDIUM | ||
| An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents. | |||||
| CVE-2025-59933 | 1 Libvips | 1 Libvips | 2026-10-19 | N/A | 7.8 HIGH |
| libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler. | |||||
| CVE-2025-12745 | 1 Bellard | 1 Quickjs | 2026-10-19 | 4.3 MEDIUM | 5.3 MEDIUM |
| A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery Patch name: c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea. To fix this issue, it is recommended to deploy a patch. | |||||
| CVE-2025-62787 | 1 Wazuh | 1 Wazuh | 2026-10-19 | N/A | 7.5 HIGH |
| Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2. | |||||
| CVE-2025-62792 | 1 Wazuh | 1 Wazuh | 2026-10-19 | N/A | 7.5 HIGH |
| Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0. | |||||
| CVE-2025-54901 | 1 Microsoft | 4 365 Apps, Excel, Office and 1 more | 2026-10-18 | N/A | 5.5 MEDIUM |
| Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |||||
| CVE-2025-47362 | 1 Qualcomm | 76 Msm8996au, Msm8996au Firmware, Qam8255p and 73 more | 2026-10-18 | N/A | 6.1 MEDIUM |
| Information disclosure while processing message from client with invalid payload. | |||||
| CVE-2025-47368 | 1 Qualcomm | 16 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 13 more | 2026-10-18 | N/A | 7.8 HIGH |
| Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. | |||||
| CVE-2025-27064 | 1 Qualcomm | 154 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 151 more | 2026-10-18 | N/A | 6.1 MEDIUM |
| Information disclosure while registering commands from clients with diag through diagHal. | |||||
| CVE-2026-96848 | 1 Microsoft | 7 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 4 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-96851 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-70041 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69957 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69954 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 5.5 MEDIUM |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69953 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69950 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69942 | 1 Microsoft | 7 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-10-16 | N/A | 7.8 HIGH |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. | |||||