Total
78 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-76151 | 2026-09-16 | N/A | N/A | ||
| Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution. | |||||
| CVE-2026-19667 | 2026-09-16 | N/A | 7.5 HIGH | ||
| If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. | |||||
| CVE-2026-69578 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-14 | N/A | 7.0 HIGH |
| Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-87529 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 9.6 CRITICAL |
| Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-80213 | 2026-09-09 | N/A | 4.0 MEDIUM | ||
| An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a label to 63 octets, and the two high bits of the length octet are reserved for compression pointers. put_string packed the length with put_pack("C", d.length) and put_label used it for labels, and thus any value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the 0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname suffix that the application validates against an allowlist becomes padding that never appears on the wire, and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the attacker's name, and DNS logs record that name rather than the one the application asked for. A label length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read as the start of a compression pointer, with the following attacker-controlled byte as the offset. | |||||
| CVE-2026-78512 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2016 and 4 more | 2026-09-09 | N/A | 8.8 HIGH |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69822 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69535 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69512 | 2026-09-09 | N/A | 8.0 HIGH | ||
| Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68880 | 2026-09-09 | N/A | 8.0 HIGH | ||
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68895 | 2026-09-08 | N/A | 5.5 MEDIUM | ||
| Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-86315 | 2026-09-08 | N/A | 6.2 MEDIUM | ||
| An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359. | |||||
| CVE-2026-65610 | 2026-08-28 | N/A | N/A | ||
| nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable. | |||||
| CVE-2026-42944 | 1 Nlnetlabs | 1 Unbound | 2026-08-26 | N/A | 7.5 HIGH |
| NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation. | |||||
| CVE-2026-77014 | 2026-08-25 | N/A | 5.3 MEDIUM | ||
| A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB. | |||||
| CVE-2026-65795 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-08-21 | N/A | 6.7 MEDIUM |
| Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-49263 | 2026-08-17 | N/A | N/A | ||
| Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue. | |||||
| CVE-2026-73523 | 2026-08-17 | N/A | 7.5 HIGH | ||
| COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus. | |||||
| CVE-2026-65797 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-08-17 | N/A | 6.7 MEDIUM |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-65798 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-08-17 | N/A | 6.7 MEDIUM |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. | |||||