Total
3831 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-54226 | 2026-10-25 | N/A | N/A | ||
| A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue. | |||||
| CVE-2026-56404 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| libexpat before 2.8.2 has an integer overflow in addBinding. | |||||
| CVE-2026-0161 | 1 Google | 1 Android | 2026-10-25 | N/A | 8.8 HIGH |
| In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-57235 | 1 Nokogiri | 1 Nokogiri | 2026-10-25 | N/A | 8.2 HIGH |
| Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4. | |||||
| CVE-2026-56409 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.5 MEDIUM |
| xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | |||||
| CVE-2026-56405 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| libexpat before 2.8.2 has an integer overflow in getAttributeId. | |||||
| CVE-2026-0128 | 1 Google | 1 Android | 2026-10-25 | N/A | 6.5 MEDIUM |
| In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | |||||
| CVE-2026-56411 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | |||||
| CVE-2026-12244 | 1 Nlnetlabs | 1 Nsd | 2026-10-25 | N/A | 8.8 HIGH |
| If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes | |||||
| CVE-2026-56407 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | |||||
| CVE-2026-0148 | 1 Google | 1 Android | 2026-10-25 | N/A | 8.8 HIGH |
| In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-56406 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | |||||
| CVE-2026-56403 | 1 Libexpat Project | 1 Libexpat | 2026-10-25 | N/A | 6.9 MEDIUM |
| libexpat before 2.8.2 has an integer overflow in storeAtts. | |||||
| CVE-2026-54679 | 1 Jqlang | 1 Jq | 2026-10-25 | N/A | 5.5 MEDIUM |
| jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2. | |||||
| CVE-2026-52972 | 1 Linux | 1 Linux Kernel | 2026-10-25 | N/A | 5.5 MEDIUM |
| In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000. | |||||
| CVE-2026-48933 | 1 Nodejs | 1 Node.js | 2026-10-25 | N/A | 7.5 HIGH |
| A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |||||
| CVE-2026-46463 | 1 Dell | 1 Data Domain Operating System | 2026-10-25 | N/A | 6.5 MEDIUM |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. | |||||
| CVE-2026-53482 | 1 Dell | 1 Data Domain Operating System | 2026-10-25 | N/A | 7.5 HIGH |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. | |||||
| CVE-2026-58472 | 1 Gnu | 1 Wget | 2026-10-25 | N/A | 5.9 MEDIUM |
| GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase. | |||||
| CVE-2026-53763 | 1 Trustedfirmware | 1 Op-tee | 2026-10-25 | N/A | 3.8 LOW |
| OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.0.0 and prior to version 4.11.0, 32-bit integer overflows in OP-TEE core's AES-GCM implementation cause the authentication tag to be computed with incorrect bit-length values after processing more than 512 megabytes of payload or Additional Authenticated Data (AAD). Version 4.11.0 contains a patch. No known workarounds are available. | |||||