Export limit exceeded: 409264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409264 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-47218 | 2026-10-15 | N/A | ||
| runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1. | ||||
| CVE-2026-12655 | 2026-10-15 | N/A | ||
| A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration. | ||||
| CVE-2026-111230 | 1 Netgate | 1 Pfsense | 2026-10-15 | 4.9 Medium |
| Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log. | ||||
| CVE-2026-111225 | 1 Netgate | 1 Pfsense | 2026-10-15 | 5 Medium |
| Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled. | ||||
| CVE-2026-111220 | 1 Netgate | 1 Pfsense | 2026-10-15 | 7.2 High |
| pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule. | ||||
| CVE-2026-111215 | 1 Netgate | 1 Pfsense | 2026-10-15 | 7.2 High |
| Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. | ||||
| CVE-2026-111171 | 2026-10-15 | 5.4 Medium | ||
| Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services. | ||||
| CVE-2026-111168 | 1 Libredesk | 1 Libredesk | 2026-10-15 | 5.4 Medium |
| LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session. | ||||
| CVE-2026-111166 | 1 Raphael Assenat | 1 Libmikmod | 2026-10-15 | 5.5 Medium |
| libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file. | ||||
| CVE-2026-111163 | 1 Mindwerks | 1 Wildmidi | 2026-10-15 | 5.5 Medium |
| WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application. | ||||
| CVE-2026-111161 | 2026-10-15 | 6.1 Medium | ||
| libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine. | ||||
| CVE-2026-111158 | 2026-10-15 | 5.5 Medium | ||
| EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process. | ||||
| CVE-2026-111156 | 2026-10-15 | 6.1 Medium | ||
| libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes. | ||||
| CVE-2026-111153 | 1 Game-music-emu Project | 1 Game-music-emu | 2026-10-15 | 5.5 Medium |
| Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service. | ||||
| CVE-2026-111151 | 2026-10-15 | 6.1 Medium | ||
| OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes. | ||||
| CVE-2026-111148 | 2026-10-15 | 5.5 Medium | ||
| libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer. | ||||
| CVE-2026-111146 | 1 Ytnef Project | 1 Ytnef | 2026-10-15 | 6.1 Medium |
| ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes. | ||||
| CVE-2026-111143 | 1 Ansilove | 1 Libansilove | 2026-10-15 | 5.5 Medium |
| Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art. | ||||
| CVE-2026-111141 | 1 Gdraheim | 1 Zziplib | 2026-10-15 | 4.7 Medium |
| zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process. | ||||
| CVE-2026-111138 | 1 Netsurf-browser | 1 Libnsbmp | 2026-10-15 | 5.5 Medium |
| NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images. | ||||