Export limit exceeded: 400321 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400321 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400321 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102719 | 1 Eclipse | 1 Netxduo | 2026-09-30 | N/A |
| Predictable DTLS HelloVerifyRequest Cookie in NetX Secure | ||||
| CVE-2026-102721 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose only limits are the destination buffer and a NUL byte: ```c /* addons/tftp/nxd_tftp_client.c:1769 */ for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++) ``` Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no terminating NUL, which a server controls completely, walks the loop off the end of the packet until it happens to meet a zero byte or fills the 64 byte destination. ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x60d0000000c8 thread T4 #0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769 0x60d0000000c8 is 0 bytes to the right of 136-byte region ``` The open path has the same loop at :1327 and reports the same way. What is read lands in `nx_tftp_client_error_string`, which the application is expected to display or log, so adjacent packet pool memory ends up in whatever the device does with the error text. Add `(buffer_ptr < packet_ptr -> nx_packet_append_ptr)` to the loop condition in all three paths. | ||||
| CVE-2026-102722 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there. | ||||
| CVE-2026-102723 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| NULL Pointer Dereference on MSRP Attribute Table Exhaustion | ||||
| CVE-2026-102724 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| NULL Pointer Dereference When Evicting the Sole MSRP Attribute | ||||
| CVE-2026-102725 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| Out-of-bounds Read from Unvalidated MSRP Attribute List Length | ||||
| CVE-2026-102726 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read | ||||
| CVE-2026-102639 | 1 Mobilitydb | 1 Mobilitydb | 2026-09-30 | 6.5 Medium |
| MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative length value wraps to a large unsigned size_t due to missing signed validation, bypasses an overflow-unsafe pointer arithmetic bounds check in wkb_parse_state_check(), and causes memcpy() in text_from_wkb_state() to operate with a corrupted unbounded length, resulting in a remote denial-of-service condition affecting all sessions on the PostgreSQL instance. | ||||
| CVE-2026-102727 | 1 Eclipse | 1 Netx Duo | 2026-09-30 | N/A |
| FTP Passive Data Connection Not Bound to the Authenticated Control Peer | ||||
| CVE-2026-102729 | 1 Eclipse | 1 Guix | 2026-09-30 | N/A |
| `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer. | ||||
| CVE-2026-102730 | 1 Eclipse | 1 Threadx/levelx(nand Driver) | 2026-09-30 | N/A |
| Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.) | ||||
| CVE-2026-61519 | 1 Liberu Software | 1 Liberu Crm | 2026-09-30 | 8.8 High |
| Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data. | ||||
| CVE-2026-102144 | 2026-09-30 | 5.3 Medium | ||
| A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service. | ||||
| CVE-2026-19587 | 2 Samsung, Samsung Open Source | 2 Rlottie, Rlottie | 2026-09-30 | 6.5 Medium |
| Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. | ||||
| CVE-2026-76728 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-09-30 | 7.2 High |
| A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-76734 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-09-30 | 4.8 Medium |
| A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component. | ||||
| CVE-2026-76735 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-09-30 | 4.1 Medium |
| A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met. | ||||
| CVE-2026-76738 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-09-30 | 2.7 Low |
| A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention. | ||||
| CVE-2026-96274 | 1 Baicells | 1 Nova 430h Enodeb (model Pbs3101sh) | 2026-09-30 | 7.4 High |
| In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the eNodeB and core network re-establish connectivity. | ||||
| CVE-2026-100291 | 1 Anjvision | 1 Yssd-rtmp-h5 | 2026-09-30 | 9.8 Critical |
| In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations. | ||||