Total
580 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-47403 | 1 Qualcomm | 514 Ar8035, Ar8035 Firmware, Cologne and 511 more | 2026-10-07 | N/A | 6.5 MEDIUM |
| Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. | |||||
| CVE-2025-47330 | 1 Qualcomm | 446 Ar8031, Ar8031 Firmware, Ar8035 and 443 more | 2026-10-07 | N/A | 5.5 MEDIUM |
| Transient DOS while parsing video packets received from the video firmware. | |||||
| CVE-2025-47400 | 1 Qualcomm | 22 Pandeiro, Pandeiro Firmware, Snapdragon 8 Elite Gen 5 and 19 more | 2026-10-07 | N/A | 7.1 HIGH |
| Cryptographic issue while copying data to a destination buffer without validating its size. | |||||
| CVE-2025-47331 | 1 Qualcomm | 598 Ar8031, Ar8031 Firmware, Ar8035 and 595 more | 2026-10-07 | N/A | 6.1 MEDIUM |
| Information disclosure while processing a firmware event. | |||||
| CVE-2025-47395 | 1 Qualcomm | 2 Wcn7861, Wcn7861 Firmware | 2026-10-07 | N/A | 6.5 MEDIUM |
| Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. | |||||
| CVE-2026-96420 | 1 Wireshark | 1 Wireshark | 2026-10-06 | N/A | 4.7 MEDIUM |
| Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |||||
| CVE-2026-86243 | 1 Apache | 1 Tomcat Native | 2026-10-06 | N/A | 7.5 HIGH |
| Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue. | |||||
| CVE-2026-102758 | 2026-09-30 | N/A | 7.5 HIGH | ||
| The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c ``` UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type, USHORT *tlv_tag_class, ULONG *tlv_length, const UCHAR **tlv_data, ULONG *header_length) { UINT current_index; USHORT current_tag; ULONG length; ULONG length_bytes; current_index = 0; current_tag = buffer[current_index]; /* <-- read before the bounds check */ if (*buffer_length < 1) { return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG); } ``` The remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes > 4 || length_bytes > *buffer_length` before its read loop, the decoded value is checked against `length > *buffer_length`, and the second single-byte length read follows its own `*buffer_length < 1` guard. The tag read is the only load placed ahead of its check. | |||||
| CVE-2026-102728 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard. | |||||
| CVE-2026-94286 | 2026-09-30 | N/A | 7.1 HIGH | ||
| An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. | |||||
| CVE-2026-97399 | 2026-09-29 | N/A | 3.7 LOW | ||
| The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable. | |||||
| CVE-2025-43892 | 1 Fortinet | 2 Fortios, Fortiproxy | 2026-09-29 | N/A | 4.3 MEDIUM |
| A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request. | |||||
| CVE-2025-12106 | 1 Openvpn | 1 Openvpn | 2026-09-26 | N/A | 9.1 CRITICAL |
| Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | |||||
| CVE-2025-21484 | 1 Qualcomm | 346 Apq8064au, Apq8064au Firmware, Aqt1000 and 343 more | 2026-09-26 | N/A | 8.2 HIGH |
| Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. | |||||
| CVE-2025-27033 | 1 Qualcomm | 64 Qca6698aq, Qca6698aq Firmware, Qcm5430 and 61 more | 2026-09-26 | N/A | 6.1 MEDIUM |
| Information disclosure while running video usecase having rogue firmware. | |||||
| CVE-2025-27030 | 1 Qualcomm | 82 C-v2x 9150, C-v2x 9150 Firmware, Qam8295p and 79 more | 2026-09-26 | N/A | 6.1 MEDIUM |
| information disclosure while invoking calibration data from user space to update firmware size. | |||||
| CVE-2025-21487 | 1 Qualcomm | 454 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 451 more | 2026-09-26 | N/A | 8.2 HIGH |
| Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. | |||||
| CVE-2025-21488 | 1 Qualcomm | 216 Fastconnect 6200, Fastconnect 6200 Firmware, Fastconnect 6700 and 213 more | 2026-09-26 | N/A | 8.2 HIGH |
| Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. | |||||
| CVE-2025-27036 | 1 Qualcomm | 42 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 39 more | 2026-09-26 | N/A | 6.1 MEDIUM |
| Information disclosure when Video engine escape input data is less than expected minimum size. | |||||
| CVE-2026-78516 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-25 | N/A | 4.3 MEDIUM |
| Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. | |||||