Total
14854 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40257 | 1 Trustedfirmware | 1 Op-tee | 2026-07-07 | N/A | 5.5 MEDIUM |
| OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.21.0 and prior to version 4.11.0, the ARM Crypto Extensions accelerated SHA-3 implementation has an off-by-one error that can cause a massive heap overflow that corrupts all TEE kernel memory following the hash state. This affects all platforms built with `CFG_CRYPTO_WITH_CE82=y` (ARMv8.2+ with SHA3 Crypto Extensions). Version 4.11.0 contains a patch. As a workaround, disable SHA3 Crypto Extensions with `CFG_CRYPTO_WITH_CE82=n`. | |||||
| CVE-2026-21384 | 1 Qualcomm | 158 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 155 more | 2026-07-07 | N/A | 5.3 MEDIUM |
| Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits. | |||||
| CVE-2026-53136 | 1 Linux | 1 Linux Kernel | 2026-07-07 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe. Clamp each register count to the destination array size using min_t() before the copy loops, in both get_integrated_info_v11() and get_integrated_info_v2_1(). (cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69) | |||||
| CVE-2026-53137 | 1 Linux | 1 Linux Kernel | 2026-07-07 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size of the destination buffer rx_id_list[177]. A malicious HDMI repeater could advertise a message size larger than the buffer, causing an out-of-bounds write during the I2C read. Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the approach already used in the DP branch. (cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09) | |||||
| CVE-2026-21368 | 1 Qualcomm | 182 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 179 more | 2026-07-07 | N/A | 5.3 MEDIUM |
| Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks. | |||||
| CVE-2026-21369 | 1 Qualcomm | 218 Fastconnect 6200, Fastconnect 6200 Firmware, Fastconnect 6700 and 215 more | 2026-07-07 | N/A | 5.3 MEDIUM |
| Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification. | |||||
| CVE-2026-21370 | 1 Qualcomm | 182 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 179 more | 2026-07-07 | N/A | 5.3 MEDIUM |
| Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values. | |||||
| CVE-2026-3823 | 1 Blackbeartechhive | 4 Atop Ehg2408, Atop Ehg2408-2sfp, Atop Ehg2408-2sfp Firmware and 1 more | 2026-07-07 | N/A | 9.8 CRITICAL |
| EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code. | |||||
| CVE-2026-14612 | 2026-07-07 | N/A | 4.2 MEDIUM | ||
| Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon. | |||||
| CVE-2026-53173 | 1 Linux | 1 Linux Kernel | 2026-07-06 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command stream parsing loop increments the index variable a second time when a 64-bit command word is encountered (bit 14 set), but does not re-check the loop bound before writing the second word: for (i = 0; i < size / 4; i++) { bocmds[i] = cmds[0]; if (cmd & 0x4000) { i++; bocmds[i] = cmds[1]; /* unchecked */ } } The buffer bocmds is backed by a DMA allocation of exactly size bytes from drm_gem_dma_create(ddev, size), giving valid indices [0, size/4-1]. When i == size/4 - 1 on entry to an iteration and bit 14 of cmds[0] is set, bocmds[size/4-1] is written in bounds, i is then incremented to size/4, and bocmds[size/4] writes four bytes past the end of the allocation. Userspace controls both the buffer contents and the size argument via the ioctl, making this a userspace-triggerable heap out-of-bounds write. Fix by checking the incremented index against the buffer bound before the second write and returning -EINVAL if the buffer is too small to contain the extended command. | |||||
| CVE-2026-14241 | 1 Mozilla | 1 Firefox | 2026-07-06 | N/A | 9.8 CRITICAL |
| Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4. | |||||
| CVE-2026-53187 | 1 Linux | 1 Linux Kernel | 2026-07-06 | N/A | 7.1 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range. Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with no bound check. In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this turns a bad user input into a machine reboot. Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used. Reported by Smatch. | |||||
| CVE-2026-53195 | 1 Linux | 1 Linux Kernel | 2026-07-06 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header. img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically. Fix by rejecting images where img_header->Length exceeds the available destination space. | |||||
| CVE-2023-29929 | 2026-07-05 | N/A | 7.5 HIGH | ||
| Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library. | |||||
| CVE-2026-36355 | 2026-07-05 | N/A | 7.7 HIGH | ||
| The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h | |||||
| CVE-2024-42642 | 1 Crucial | 6 Ct1000mx500ssd1, Ct2000mx500ssd1, Ct250mx500ssd1 and 3 more | 2026-07-05 | N/A | 6.7 MEDIUM |
| Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page. | |||||
| CVE-2024-45993 | 1 Giflib Project | 1 Giflib | 2026-07-05 | N/A | 6.5 MEDIUM |
| Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. | |||||
| CVE-2026-14420 | 1 Google | 1 Chrome | 2026-07-03 | N/A | 9.6 CRITICAL |
| Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-14400 | 1 Google | 1 Chrome | 2026-07-03 | N/A | 8.3 HIGH |
| Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-14397 | 2 Apple, Google | 2 Macos, Chrome | 2026-07-03 | N/A | 9.6 CRITICAL |
| Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||