Total
15399 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-10881 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-07-22 | N/A | 9.6 CRITICAL |
| Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-10892 | 1 Google | 2 Android, Chrome | 2026-07-22 | N/A | 9.6 CRITICAL |
| Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-10999 | 1 Google | 1 Chrome | 2026-07-22 | N/A | 6.5 MEDIUM |
| Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-10925 | 2 Apple, Google | 2 Macos, Chrome | 2026-07-22 | N/A | 8.3 HIGH |
| Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-10719 | 2026-07-22 | N/A | N/A | ||
| Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte. | |||||
| CVE-2026-10047 | 1 Bitdefender | 1 Napoca | 2026-07-22 | N/A | 7.8 HIGH |
| The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer by 65,519 bytes. The IRET frame push can therefore write past the end of the buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned. | |||||
| CVE-2026-10046 | 1 Bitdefender | 1 Napoca | 2026-07-22 | N/A | 7.8 HIGH |
| Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned. | |||||
| CVE-2026-10718 | 2026-07-22 | N/A | N/A | ||
| Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation. | |||||
| CVE-2021-4478 | 2026-07-22 | N/A | 8.2 HIGH | ||
| Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulnerability when loading .gdt files. A crafted .gdt file can trigger a buffer overflow during file parsing, allowing an attacker to crash the application or execute malicious code on the underlying system. | |||||
| CVE-2026-45684 | 1 Opentelemetry | 1 Ebpf Instrumentation | 2026-07-22 | N/A | 4.9 MEDIUM |
| OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0. | |||||
| CVE-2026-25259 | 1 Qualcomm | 84 Cologne, Cologne Firmware, Fastconnect 6700 and 81 more | 2026-07-22 | N/A | 7.8 HIGH |
| Memory corruption while processing multiple IOCTL command for escape operations. | |||||
| CVE-2026-10717 | 2026-07-22 | N/A | N/A | ||
| Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing defect information out of bounds for very large defects lists via a very bad drive with lots of defects or a maliciously crafted SCSI device’s defect response length. | |||||
| CVE-2025-59614 | 1 Qualcomm | 42 Cologne, Cologne Firmware, Fastconnect 6900 and 39 more | 2026-07-22 | N/A | 6.7 MEDIUM |
| Memory Corruption when sending random number generator command with insufficient output buffer size. | |||||
| CVE-2025-59611 | 1 Qualcomm | 100 Aqt1000, Aqt1000 Firmware, Cologne and 97 more | 2026-07-22 | N/A | 6.7 MEDIUM |
| Memory corruption in diagnostic services due to absence of input validation | |||||
| CVE-2025-59605 | 1 Qualcomm | 280 Ar8035, Ar8035 Firmware, Csra6620 and 277 more | 2026-07-22 | N/A | 7.8 HIGH |
| Memory Corruption when processing device identifier strings that exceed the expected maximum length. | |||||
| CVE-2026-20456 | 1 Mediatek | 12 Mt7902, Mt7902 Firmware, Mt7920 and 9 more | 2026-07-22 | N/A | 5.5 MEDIUM |
| In wlan STA driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480851; Issue ID: MSV-6338. | |||||
| CVE-2026-20453 | 1 Mediatek | 72 Mt6739, Mt6739 Firmware, Mt6761 and 69 more | 2026-07-22 | N/A | 6.7 MEDIUM |
| In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10886526; Issue ID: MSV-6791. | |||||
| CVE-2026-20455 | 1 Mediatek | 72 Mt6739, Mt6739 Firmware, Mt6761 and 69 more | 2026-07-22 | N/A | 7.8 HIGH |
| In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6784. | |||||
| CVE-2026-10114 | 2026-07-22 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function handle_scp_info in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. To fix this issue, it is recommended to deploy a patch. | |||||
| CVE-2026-3083 | 1 Gstreamer | 1 Gstreamer | 2026-07-21 | N/A | 8.8 HIGH |
| GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid element, the process does not properly validate user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28850. | |||||