Total
3831 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-17705 | 1 Google | 1 Chrome | 2026-10-24 | N/A | 8.8 HIGH |
| Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-65423 | 2026-10-23 | N/A | 8.8 HIGH | ||
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. | |||||
| CVE-2026-21366 | 1 Qualcomm | 66 Lemans Au Lgit, Lemans Au Lgit Firmware, Lemansau and 63 more | 2026-10-23 | N/A | 7.8 HIGH |
| Memory corruption while processing a packet with a size close to the maximum allowed value. | |||||
| CVE-2025-49710 | 1 Mozilla | 1 Firefox | 2026-10-23 | N/A | 9.8 CRITICAL |
| An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4. | |||||
| CVE-2025-10533 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-23 | N/A | 8.8 HIGH |
| Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. | |||||
| CVE-2026-63559 | 2026-10-23 | N/A | 7.5 HIGH | ||
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. | |||||
| CVE-2026-19174 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 8.8 HIGH |
| Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-19167 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 3.1 LOW |
| Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-19028 | 2026-10-23 | N/A | N/A | ||
| H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. | |||||
| CVE-2026-20339 | 2026-10-23 | N/A | 7.5 HIGH | ||
| A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software. | |||||
| CVE-2026-15534 | 2026-10-23 | N/A | 5.7 MEDIUM | ||
| Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory. | |||||
| CVE-2026-47940 | 2 Adobe, Microsoft | 2 Lightroom, Windows | 2026-10-23 | N/A | 7.8 HIGH |
| Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-19001 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 9.8 CRITICAL |
| The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution. | |||||
| CVE-2026-69354 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-23 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69521 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-23 | N/A | 8.8 HIGH |
| Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-14181 | 1 Php | 1 Php | 2026-10-23 | N/A | 6.5 MEDIUM |
| The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow. | |||||
| CVE-2026-6103 | 1 Php | 1 Php | 2026-10-23 | N/A | 4.3 MEDIUM |
| phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine. | |||||
| CVE-2026-85363 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-50161 | 2026-10-22 | N/A | N/A | ||
| libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1. | |||||
| CVE-2026-62357 | 2026-10-22 | N/A | N/A | ||
| Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0. | |||||