Export limit exceeded: 389924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389924 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73434 | 2 Gstreamer, Redhat | 3 Gstreamer, Enterprise Linux, Enterprise Linux Eus | 2026-09-09 | 6.1 Medium |
| A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). | ||||
| CVE-2026-73433 | 2 Gstreamer, Redhat | 3 Gstreamer, Enterprise Linux, Enterprise Linux Eus | 2026-09-09 | 6.6 Medium |
| A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). | ||||
| CVE-2026-81396 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81394 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81392 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81390 | 1 Microsoft | 12 365 Apps, Excel, Excel 2016 and 9 more | 2026-09-09 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81389 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-57825 | 2026-09-09 | 5.7 Medium | ||
| In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. | ||||
| CVE-2026-81387 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-4765 | 1 Rd Station Conversas | 1 Tallos Chat | 2026-09-09 | N/A |
| Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within the context of the user’s own session who provides the payload. The demonstrated impact is limited to the user who enters and executes the payload. | ||||
| CVE-2026-78515 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-09 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-87734 | 2026-09-09 | 7.5 High | ||
| An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. | ||||
| CVE-2026-87736 | 2026-09-09 | 4.3 Medium | ||
| An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. | ||||
| CVE-2026-87819 | 1 Gitpython Project | 1 Gitpython | 2026-09-09 | 7.5 High |
| GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access. | ||||
| CVE-2026-87815 | 1 B3log | 1 Siyuan | 2026-09-09 | 8.7 High |
| SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory. | ||||
| CVE-2026-87810 | 1 B3log | 1 Siyuan | 2026-09-09 | 5.3 Medium |
| Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages. | ||||
| CVE-2026-87809 | 1 B3log | 1 Siyuan | 2026-09-09 | 6.5 Medium |
| Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks. | ||||
| CVE-2026-18023 | 1 Asus | 1 Armoury Crate | 2026-09-09 | N/A |
| Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-16003 | 1 Asus | 1 Armoury Crate | 2026-09-09 | N/A |
| Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-12611 | 1 Eclipse | 1 Jetty | 2026-09-09 | N/A |
| A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads. | ||||