CVE & CISA-KEV Catalog

Transient DOS while parsing frame during channel usage.

Published 2026-09-17

Information Disclosure when a pointer is reused after being deallocated.

Published 2026-09-17

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Published 2026-09-17

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.

Published 2026-09-17

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

Published 2026-09-17

A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

Published 2026-09-14

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

Published 2026-09-10

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in Windows Storage allows an unauthorized attacker to disclose information with a physical attack.

Published 2026-09-08

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.

Published 2026-09-08

Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

Published 2026-09-08

Use after free in Windows Overlay Filter allows an authorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

Published 2026-09-08

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally.

Published 2026-09-08

Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

Published 2026-09-08

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

Published 2026-09-08

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

Published 2026-09-08

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.

Published 2026-09-07

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Published 2026-09-01

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Published 2026-08-27

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.

Published 2026-08-20

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

Published 2026-08-20

Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Published 2026-08-19

ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Published 2026-08-19

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Published 2026-08-14

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Published 2026-08-14

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

Published 2026-08-13

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

Published 2026-08-13

Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Published 2026-08-13

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

Published 2026-08-11

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Published 2026-08-11

Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.

Published 2026-08-11

Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

Published 2026-08-11

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Published 2026-08-11

Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

Published 2026-08-11

Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally.

Published 2026-08-11

Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally.

Published 2026-08-11

Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

Published 2026-08-11

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Published 2026-08-11

Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Published 2026-08-07

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management interface. An attacker could exploit this vulnerability by authenticating with a malformed certificate. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Published 2026-08-05