Total
3831 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57432 | 1 Perl | 1 Perl | 2026-10-24 | N/A | 8.4 HIGH |
| Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller. | |||||
| CVE-2026-13221 | 1 Perl | 1 Perl | 2026-10-24 | N/A | 9.1 CRITICAL |
| Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong. | |||||
| CVE-2026-15551 | 1 Samsung | 1 Rlottie | 2026-10-24 | N/A | 5.5 MEDIUM |
| Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects . | |||||
| CVE-2026-59197 | 1 Python | 1 Pillow | 2026-10-24 | N/A | 8.2 HIGH |
| Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0. | |||||
| CVE-2026-55012 | 1 Microsoft | 1 Malware Protection Engine | 2026-10-24 | N/A | 7.8 HIGH |
| Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-10669 | 1 Zephyrproject | 1 Zephyr | 2026-10-24 | N/A | 7.8 HIGH |
| On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of the buffer wraps the 32-bit address space (size + alignment offset near SIZE_MAX, or ROUND_UP(size + offset) overflowing to 0), the loop executes zero iterations and the function returns 0 = permitted without probing any MPU region. The syscall-layer pre-checks (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) only catch a raw addr+size wrap and do not cover the ROUND_UP-induced wrap, and the string path (arch_user_string_nlen -> arch_buffer_validate) has no syscall-layer guard at all. An unprivileged user-mode thread can therefore pass a crafted (addr, size) to any syscall that validates user buffers via k_usermode_from_copy/to_copy or k_usermode_string_copy and have validation succeed for memory it must not access; the kernel then reads from (disclosure) or, with write=1, writes to (corruption) attacker-chosen kernel or other-partition memory on the thread's behalf, enabling information disclosure, memory corruption, privilege escalation, and denial of service. Affected from v3.7.0 (when Xtensa MPU userspace support was added) through v4.4.0. The fix changes the default to -EINVAL (deny by default), adds an explicit size_add_overflow check, and sets the success value only after the full range has been validated. | |||||
| CVE-2026-59199 | 1 Python | 1 Pillow | 2026-10-24 | N/A | 7.5 HIGH |
| Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0. | |||||
| CVE-2026-48342 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-10-24 | N/A | 7.8 HIGH |
| Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-16389 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-41521 | 1 Neutrinolabs | 1 Xrdp | 2026-10-24 | N/A | 8.2 HIGH |
| xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1. | |||||
| CVE-2026-16395 | 1 Mozilla | 1 Firefox | 2026-10-24 | N/A | 9.8 CRITICAL |
| Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-59117 | 1 Microsoft | 1 Terminal | 2026-10-24 | N/A | 7.5 HIGH |
| Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-16408 | 1 Mozilla | 1 Firefox | 2026-10-24 | N/A | 9.8 CRITICAL |
| Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16369 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16402 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-47251 | 1 Struktur | 1 Libheif | 2026-10-24 | N/A | 6.1 MEDIUM |
| libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue. | |||||
| CVE-2026-47714 | 1 Struktur | 1 Libheif | 2026-10-24 | N/A | 6.1 MEDIUM |
| libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue. | |||||
| CVE-2026-16416 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 9.3 CRITICAL |
| Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High) | |||||
| CVE-2026-55400 | 1 Absolute | 1 Secure Access | 2026-10-24 | N/A | 6.5 MEDIUM |
| CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service. | |||||
| CVE-2026-73086 | 2026-10-24 | N/A | 7.4 HIGH | ||
| nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11. | |||||