232 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-118769 | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size con | CRITICAL | 9.2 | 30%ile | NVD | 2026-10-29 |
| CVE-2026-89786 | ext4: fix out-of-bounds read in ext4_read_inline_dir() | CRITICAL | 9.1 | 53%ile | Microsoft | 2026-09-08 |
| CVE-2026-68160 | ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() | CRITICAL | 9.1 | 56%ile | Microsoft | 2026-08-11 |
| CVE-2026-58023 | Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path | CRITICAL | 9.1 | 63%ile | Microsoft | 2026-07-14 |
| CVE-2026-57075 | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64 | CRITICAL | 9.1 | 50%ile | Microsoft | 2026-07-14 |
| CVE-2026-86929 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, m | HIGH | 8.8 | 51%ile | NVD | 2026-10-26 |
| CVE-2024-58400 | llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal t | HIGH | 8.8 | 36%ile | NVD | 2026-10-27 |
| CVE-2026-100236 | Dpdk: dpdk: heap out-of-bounds read/write in gso header copy | HIGH | 8.6 | 25%ile | Microsoft | 2026-10-13 |
| CVE-2026-119722 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skip | HIGH | 8.5 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-89781 | fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() | HIGH | 8.4 | 8%ile | Microsoft | 2026-09-08 |
| CVE-2026-9535 | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A | HIGH | 8.2 | 18%ile | NVD | 2026-10-29 |
| CVE-2026-98190 | wifi: wilc1000: fix out-of-bounds read in P2P public action frames | HIGH | 8.2 | 7%ile | Microsoft | 2026-10-13 |
| CVE-2026-57235 | Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` | HIGH | 8.2 | 37%ile | Microsoft | 2026-06-09 |
| CVE-2026-98602 | Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough | HIGH | 8.1 | 12%ile | Microsoft | 2026-10-13 |
| CVE-2026-62958 | libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host | HIGH | 7.9 | 10%ile | NVD | 2026-10-30 |
| CVE-2026-82961 | The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode call | HIGH | 7.8 | 2%ile | NVD | 2026-10-28 |
| CVE-2026-57077 | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len | HIGH | 7.7 | 8%ile | Microsoft | 2026-07-14 |
| CVE-2026-115484 | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | HIGH | 7.6 | 13%ile | Microsoft | 2026-10-13 |
| CVE-2026-104594 | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allow | HIGH | 7.5 | 40%ile | NVD | 2026-10-26 |
| CVE-2026-104596 | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/ | HIGH | 7.5 | 33%ile | NVD | 2026-10-26 |
| CVE-2026-104597 | libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a r | HIGH | 7.5 | 14%ile | NVD | 2026-10-26 |
| CVE-2026-104598 | libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a rem | HIGH | 7.5 | 14%ile | NVD | 2026-10-26 |
| CVE-2026-90869 | A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress S | HIGH | 7.5 | 29%ile | NVD | 2026-10-29 |
| CVE-2025-68256 | staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser | HIGH | 7.5 | 20%ile | Microsoft | 2025-12-09 |
| CVE-2026-57585 | MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error | HIGH | 7.5 | 42%ile | Microsoft | 2026-06-09 |
| CVE-2026-9076 | Out-of-Bounds Read in CMS Password-Based Decryption | HIGH | 7.5 | 53%ile | Microsoft | 2026-06-09 |
| CVE-2026-66034 | libssh2 Heap Out-of-Bounds Read via publickey subsystem | HIGH | 7.5 | 34%ile | Microsoft | 2026-07-14 |
| CVE-2026-93543 | Out-of-bounds read in libXi's XI2 class parser | HIGH | 7.4 | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-61627 | libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. P | HIGH | 7.3 | 5%ile | NVD | 2026-10-30 |
| CVE-2026-5089 | YAML::Syck versions before 1.38 for Perl has an out-of-bounds read | HIGH | 7.3 | 35%ile | Microsoft | 2026-05-12 |
| CVE-2026-93862 | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster inte | HIGH | 7.2 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-113912 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26 | HIGH | 7.1 | 32%ile | NVD | 2026-10-26 |
| CVE-2026-99112 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after | HIGH | 7.1 | 3%ile | NVD | 2026-10-28 |
| CVE-2026-111734 | P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherTy | HIGH | 7.1 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-111735 | P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame whil | HIGH | 7.1 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-98204 | Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() | HIGH | 7.1 | 7%ile | Microsoft | 2026-10-13 |
| CVE-2025-66293 | LIBPNG has an out-of-bounds read in png_image_read_composite | HIGH | 7.1 | 29%ile | Microsoft | 2025-12-09 |
| CVE-2025-68254 | staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing | HIGH | 7.1 | 20%ile | Microsoft | 2025-12-09 |
| CVE-2026-89785 | fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init | HIGH | 7.1 | 11%ile | Microsoft | 2026-09-08 |
| CVE-2026-90230 | nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() | HIGH | 7.1 | 40%ile | Microsoft | 2026-09-08 |
| CVE-2026-90419 | nilfs2: prevent out-of-bounds read in super root block parsing | HIGH | 7.1 | 7%ile | Microsoft | 2026-09-08 |
| CVE-2026-94286 | Out-of-bounds read in libXtst's RECORD reply parser | HIGH | 7.1 | 10%ile | Microsoft | 2026-09-08 |
| CVE-2026-56136 | In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attack | HIGH | 7.1 | 2%ile | Microsoft | 2026-08-11 |
| CVE-2026-72568 | Redis - Heap Out-of-Bounds Read in Cluster Bus PING Message Handler | HIGH | 7.1 | — | Microsoft | 2026-08-11 |
| CVE-2026-53268 | netfilter: conntrack_irc: fix possible out-of-bounds read | HIGH | 7.1 | 44%ile | Microsoft | 2026-06-09 |
| CVE-2026-53402 | fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() | HIGH | 7.1 | 6%ile | Microsoft | 2026-07-14 |
| CVE-2025-39735 | jfs: fix slab-out-of-bounds read in ea_get() | HIGH | 7.1 | 22%ile | Microsoft | 2025-04-08 |
| CVE-2026-106435 | MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element | HIGH | — | 1%ile | GitHub | 2026-10-27 |
| CVE-2026-116735 | libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-26 |
| CVE-2026-116736 | Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-26 |
| CVE-2026-116737 | libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_pat | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-26 |
| CVE-2026-116744 | ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that | MEDIUM | 6.9 | 37%ile | NVD | 2026-10-26 |
| CVE-2024-58399 | llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-116840 | llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE- | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-117555 | CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an i | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-117557 | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/ | MEDIUM | 6.9 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-117608 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers t | MEDIUM | 6.9 | 3%ile | NVD | 2026-10-28 |
| CVE-2026-119053 | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writ | MEDIUM | 6.9 | 42%ile | NVD | 2026-10-29 |
| CVE-2026-104063 | Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when de | MEDIUM | 6.9 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-119721 | Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in r | MEDIUM | 6.9 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-119338 | Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys t | MEDIUM | 6.9 | 3%ile | NVD | 2026-10-30 |
| CVE-2026-120437 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in | MEDIUM | 6.9 | — | NVD | 2026-11-02 |
| CVE-2026-116725 | gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject RO | MEDIUM | 6.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2026-116728 | libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024 | MEDIUM | 6.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2026-116730 | Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ | MEDIUM | 6.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2025-71439 | llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows a | MEDIUM | 6.8 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-116841 | DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_f | MEDIUM | 6.8 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-119720 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that read | MEDIUM | 6.8 | 2%ile | NVD | 2026-10-30 |
| CVE-2026-104592 | libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allo | MEDIUM | 6.5 | 18%ile | NVD | 2026-10-26 |
| CVE-2026-112629 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | MEDIUM | 6.5 | 49%ile | NVD | 2026-10-26 |
| CVE-2026-112634 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | MEDIUM | 6.5 | 48%ile | NVD | 2026-10-26 |
| CVE-2026-86954 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | MEDIUM | 6.5 | 46%ile | NVD | 2026-10-26 |
| CVE-2026-85769 | Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize | MEDIUM | 6.5 | 36%ile | Microsoft | 2026-09-08 |
| CVE-2026-93541 | Out-of-bounds read in libXi's XQueryDeviceState() | MEDIUM | 6.5 | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-93542 | Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() | MEDIUM | 6.5 | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-93544 | Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing | MEDIUM | 6.5 | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-93545 | Out-of-bounds read in libXi's XListInputDevices() | MEDIUM | 6.5 | 12%ile | Microsoft | 2026-09-08 |
| CVE-2026-94281 | Out-of-bounds read in libXi's XListInputDevices() class parsing | MEDIUM | 6.5 | 12%ile | Microsoft | 2026-09-08 |
| CVE-2026-94283 | Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser | MEDIUM | 6.5 | 12%ile | Microsoft | 2026-09-08 |
| CVE-2026-53792 | rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block | MEDIUM | 6.5 | 24%ile | Microsoft | 2026-08-11 |
| CVE-2026-70368 | Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message | MEDIUM | 6.5 | 29%ile | Microsoft | 2026-08-11 |
| CVE-2026-58011 | Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime | MEDIUM | 6.5 | 41%ile | Microsoft | 2026-06-09 |
| CVE-2025-4969 | Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c | MEDIUM | 6.5 | 60%ile | Microsoft | 2025-05-13 |
| CVE-2026-14258 | Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling | MEDIUM | 6.5 | 34%ile | Microsoft | 2026-07-14 |
| CVE-2026-15714 | Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversi | MEDIUM | 6.5 | 33%ile | Microsoft | 2026-07-14 |
| CVE-2026-55970 | Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() | MEDIUM | 6.5 | 56%ile | Microsoft | 2026-07-14 |
| CVE-2026-57184 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2 | MEDIUM | 6.3 | 47%ile | NVD | 2026-10-26 |
| CVE-2026-116733 | flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers t | MEDIUM | 6.3 | 32%ile | NVD | 2026-10-26 |
| CVE-2026-116734 | flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier | MEDIUM | 6.3 | 32%ile | NVD | 2026-10-26 |
| CVE-2026-119600 | tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process | MEDIUM | 6.3 | 31%ile | NVD | 2026-10-30 |
| CVE-2026-115485 | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | MEDIUM | 6.3 | 10%ile | Microsoft | 2026-10-13 |
| CVE-2026-98454 | smb: client: fix create context out-of-bounds reads | MEDIUM | 6.3 | 33%ile | Microsoft | 2026-10-13 |
| CVE-2026-75032 | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder | MEDIUM | 6.3 | 15%ile | Microsoft | 2026-08-11 |
| CVE-2026-115919 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShape | MEDIUM | 6.2 | 7%ile | NVD | 2026-10-26 |
| CVE-2026-115920 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, | MEDIUM | 6.2 | 7%ile | NVD | 2026-10-26 |
| CVE-2026-72522 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same | MEDIUM | 6.2 | 9%ile | Microsoft | 2026-08-11 |
| CVE-2026-111269 | libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string | MEDIUM | 6.1 | 16%ile | Microsoft | 2026-10-13 |
| CVE-2025-40252 | net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() | MEDIUM | 6.1 | 49%ile | Microsoft | 2025-12-09 |
| CVE-2026-18090 | Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block | MEDIUM | 6.1 | 14%ile | Microsoft | 2026-09-08 |
| CVE-2026-88835 | Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb pack | MEDIUM | 6.1 | 2%ile | Microsoft | 2026-09-08 |
| CVE-2026-75900 | Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch | MEDIUM | 6.1 | 1%ile | Microsoft | 2026-08-11 |
| CVE-2026-57454 | Vim: Out-of-bounds Read with Text Properties | MEDIUM | 6.1 | 6%ile | Microsoft | 2026-06-09 |
| CVE-2026-64450 | tipc: fix out-of-bounds read in broadcast Gap ACK blocks | MEDIUM | 6.1 | 45%ile | Microsoft | 2026-07-14 |
| CVE-2026-57192 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2 | MEDIUM | 6.0 | 51%ile | NVD | 2026-10-27 |
| CVE-2026-119277 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3 | MEDIUM | 5.9 | 29%ile | NVD | 2026-10-29 |
| CVE-2026-119299 | gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes a | MEDIUM | 5.9 | 41%ile | NVD | 2026-10-30 |
| CVE-2026-98576 | nfc: llcp: fix slab-out-of-bounds reads when logging service names | MEDIUM | 5.9 | 12%ile | Microsoft | 2026-10-13 |
| CVE-2026-120457 | libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers | MEDIUM | 5.8 | — | NVD | 2026-11-02 |
| CVE-2026-93682 | Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | MEDIUM | 5.8 | 27%ile | Microsoft | 2026-09-08 |
| CVE-2026-94282 | Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion | MEDIUM | 5.6 | 2%ile | Microsoft | 2026-09-08 |
| CVE-2026-48380 | Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo | MEDIUM | 5.5 | 8%ile | NVD | 2026-10-27 |
| CVE-2026-46571 | In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an a | MEDIUM | 5.5 | 3%ile | Microsoft | 2026-10-13 |
| CVE-2026-94284 | Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser | MEDIUM | 5.5 | 3%ile | Microsoft | 2026-09-08 |
| CVE-2026-68184 | cdrom: fix stack out-of-bounds read in CDROMVOLCTRL | MEDIUM | 5.5 | 12%ile | Microsoft | 2026-08-11 |
| CVE-2026-4367 | Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing | MEDIUM | 5.5 | 2%ile | Microsoft | 2026-06-09 |
| CVE-2026-50262 | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes | MEDIUM | 5.5 | 3%ile | Microsoft | 2026-06-09 |
| CVE-2026-52999 | netfilter: nfnetlink_osf: fix out-of-bounds read on option matching | MEDIUM | 5.5 | 48%ile | Microsoft | 2026-06-09 |
| CVE-2026-57452 | Vim: Out-of-bounds Read with libsodium-encrypted Files | MEDIUM | 5.5 | 6%ile | Microsoft | 2026-06-09 |
| CVE-2026-46155 | smb/client: fix out-of-bounds read in smb2_compound_op() | MEDIUM | 5.5 | 41%ile | Microsoft | 2026-05-12 |
| CVE-2026-46185 | smb/client: fix out-of-bounds read in symlink_data() | MEDIUM | 5.5 | 44%ile | Microsoft | 2026-05-12 |
| CVE-2026-46190 | mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() | MEDIUM | 5.5 | 3%ile | Microsoft | 2026-05-12 |
| CVE-2026-64299 | tracing: Prevent out-of-bounds read in glob matching | MEDIUM | 5.5 | 6%ile | Microsoft | 2026-07-14 |
| CVE-2026-64487 | ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser | MEDIUM | 5.5 | 8%ile | Microsoft | 2026-07-14 |
| CVE-2026-116463 | A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the compone | MEDIUM | 5.3 | 14%ile | NVD | 2026-10-26 |
| CVE-2026-105946 | Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows rem | MEDIUM | 5.3 | 40%ile | NVD | 2026-10-27 |
| CVE-2026-117556 | zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes t | MEDIUM | 5.3 | 26%ile | NVD | 2026-10-27 |
| CVE-2026-103390 | An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Sma | MEDIUM | 5.3 | 38%ile | NVD | 2026-10-28 |
| CVE-2026-115795 | P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next b | MEDIUM | 5.3 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-20555 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of serv | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20560 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20561 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of ser | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20594 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of serv | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20596 | In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of s | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20597 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of serv | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-20598 | In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-68590 | In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial o | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-71222 | Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing | MEDIUM | 5.3 | 1%ile | Microsoft | 2026-09-08 |
| CVE-2026-12969 | Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation | MEDIUM | 5.3 | 17%ile | Microsoft | 2026-06-09 |
| CVE-2026-57451 | Vim: Out-of-bounds Read in Text Property Count | MEDIUM | 5.3 | 5%ile | Microsoft | 2026-06-09 |
| CVE-2026-16768 | Gdk-pixbuf: out-of-bounds read in ico parser | MEDIUM | 5.3 | 35%ile | Microsoft | 2026-07-14 |
| CVE-2026-120452 | libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allo | MEDIUM | 5.2 | — | NVD | 2026-11-02 |
| CVE-2026-98485 | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | MEDIUM | 5.1 | 7%ile | Microsoft | 2026-10-13 |
| CVE-2026-98810 | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() | MEDIUM | 5.1 | 5%ile | Microsoft | 2026-10-13 |
| CVE-2026-94285 | Out-of-bounds read in libX11's byte-oriented codeset parser | MEDIUM | 5.1 | 4%ile | Microsoft | 2026-09-08 |
| CVE-2026-116726 | Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify fil | MEDIUM | 4.8 | 2%ile | NVD | 2026-10-26 |
| CVE-2026-116727 | gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM comma | MEDIUM | 4.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2026-116729 | libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a | MEDIUM | 4.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2026-116732 | libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table | MEDIUM | 4.8 | 3%ile | NVD | 2026-10-26 |
| CVE-2026-120453 | The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hf | MEDIUM | 4.8 | — | NVD | 2026-11-02 |
| CVE-2026-98643 | bpf: Fix out-of-bounds read of rtt_min in sock_ops | MEDIUM | 4.4 | 11%ile | Microsoft | 2026-10-13 |
| CVE-2026-89726 | lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() | MEDIUM | 4.4 | 7%ile | Microsoft | 2026-09-08 |
| CVE-2026-74689 | net/atm: fix slab-out-of-bounds read in vcc_setsockopt() | MEDIUM | 4.4 | 3%ile | Microsoft | 2026-08-11 |
| CVE-2026-107472 | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Q | MEDIUM | 4.3 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-58496 | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's | MEDIUM | 4.3 | 11%ile | NVD | 2026-10-27 |
| CVE-2026-103393 | An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adj | MEDIUM | 4.3 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-93009 | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option b | MEDIUM | 4.3 | 10%ile | NVD | 2026-10-29 |
| CVE-2026-119272 | Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside | MEDIUM | 4.3 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-87875 | Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound | MEDIUM | 4.3 | 33%ile | Microsoft | 2026-09-08 |
| CVE-2026-80772 | HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() | MEDIUM | 4.3 | 12%ile | Microsoft | 2026-09-08 |
| CVE-2026-98155 | accel/qaic: Address potential out-of-bounds read in resp_worker() | MEDIUM | 4.2 | 2%ile | Microsoft | 2026-09-08 |
| CVE-2026-47104 | libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array() | MEDIUM | 4.0 | 3%ile | Microsoft | 2026-05-12 |
| CVE-2026-115456 | A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminat | LOW | 3.7 | 13%ile | NVD | 2026-10-30 |
| CVE-2026-89160 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF su | LOW | 3.7 | 19%ile | Microsoft | 2026-09-08 |
| CVE-2026-108330 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. | LOW | 3.6 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-118475 | A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata | LOW | 3.6 | 1%ile | NVD | 2026-10-30 |
| CVE-2026-118608 | Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. Thi | LOW | 3.5 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-85498 | A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authenticatio | LOW | 3.5 | 18%ile | NVD | 2026-10-29 |
| CVE-2026-74671 | ima: fix out-of-bounds read in xattr_verify() | LOW | 3.4 | 7%ile | Microsoft | 2026-08-11 |
| CVE-2026-112922 | A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a spec | LOW | 3.3 | 3%ile | NVD | 2026-10-30 |
| CVE-2026-88842 | Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption | LOW | 3.3 | 5%ile | Microsoft | 2026-10-13 |
| CVE-2026-98384 | bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() | LOW | 3.3 | 5%ile | Microsoft | 2026-10-13 |
| CVE-2026-80598 | ntfs3: fix out-of-bounds read in decompress_lznt | LOW | 3.3 | 7%ile | Microsoft | 2026-08-11 |
| CVE-2026-98839 | vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() | LOW | 3.0 | 6%ile | Microsoft | 2026-10-13 |
| CVE-2026-93213 | of: fix out-of-bounds read in of_alias_scan() stem parser | LOW | 3.0 | 7%ile | Microsoft | 2026-09-08 |
| CVE-2026-86137 | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro i | LOW | 2.9 | 9%ile | Microsoft | 2026-09-08 |
| CVE-2026-89156 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF da | LOW | 2.9 | 22%ile | Microsoft | 2026-09-08 |
| CVE-2026-74567 | keys: fix out-of-bounds read in keyring_get_key_chunk() | LOW | 2.5 | 2%ile | Microsoft | 2026-08-11 |
| CVE-2026-112413 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112423 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112424 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112425 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112429 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112451 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 26%ile | NVD | 2026-10-26 |
| CVE-2026-112466 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112475 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112476 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112478 | An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2 | UNKNOWN | — | 10%ile | NVD | 2026-10-26 |
| CVE-2026-112479 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112481 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112491 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112495 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 10%ile | NVD | 2026-10-26 |
| CVE-2026-112508 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112515 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112525 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112529 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 10%ile | NVD | 2026-10-26 |
| CVE-2026-112546 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112554 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 13%ile | NVD | 2026-10-26 |
| CVE-2026-112560 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112561 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112604 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS | UNKNOWN | — | 12%ile | NVD | 2026-10-26 |
| CVE-2026-112607 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macO | UNKNOWN | — | 25%ile | NVD | 2026-10-26 |
| CVE-2026-112608 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Go | UNKNOWN | — | 6%ile | NVD | 2026-10-26 |
| CVE-2026-112622 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-112627 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 15%ile | NVD | 2026-10-26 |
| CVE-2026-112642 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 15%ile | NVD | 2026-10-26 |
| CVE-2026-112656 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 15%ile | NVD | 2026-10-26 |
| CVE-2026-112680 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iP | UNKNOWN | — | 7%ile | NVD | 2026-10-26 |
| CVE-2026-112699 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iP | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113935 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 10%ile | NVD | 2026-10-26 |
| CVE-2026-113936 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113937 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 7%ile | NVD | 2026-10-26 |
| CVE-2026-113938 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113940 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113941 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113942 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 10%ile | NVD | 2026-10-26 |
| CVE-2026-113944 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-113945 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app | UNKNOWN | — | 8%ile | NVD | 2026-10-26 |
| CVE-2026-65384 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2. | UNKNOWN | — | 16%ile | NVD | 2026-10-26 |
| CVE-2026-86942 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 15%ile | NVD | 2026-10-26 |
| CVE-2026-86970 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, | UNKNOWN | — | 14%ile | NVD | 2026-10-26 |
| CVE-2026-86973 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iP | UNKNOWN | — | 9%ile | NVD | 2026-10-26 |
| CVE-2026-115942 | A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certif | UNKNOWN | — | 3%ile | NVD | 2026-10-29 |
| CVE-2026-111959 | Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 5 | UNKNOWN | — | — | NVD | 2026-11-02 |
| CVE-2026-102164 | Security Advisory 0196 | UNKNOWN | — | 9%ile | Arista | 2026-10-02 |
| CVE-2026-75819 | Out-of-bounds Read in GNU Aspell | UNKNOWN | — | 2%ile | Microsoft | 2026-10-13 |
| CVE-2026-98648 | s390/uv: Prevent potential out-of-bounds read | UNKNOWN | — | 6%ile | Microsoft | 2026-10-13 |
| CVE-2026-79616 | Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick | UNKNOWN | — | 4%ile | Microsoft | 2026-09-08 |
| CVE-2026-19028 | HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read | UNKNOWN | — | 9%ile | Microsoft | 2026-08-11 |
| CVE-2026-55894 | Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode | UNKNOWN | — | 9%ile | Microsoft | 2026-08-11 |
| CVE-2026-63383 | Libevent: decode_tag_internal() can lead to out-of-bounds read | UNKNOWN | — | 42%ile | Microsoft | 2026-08-11 |
| CVE-2026-52859 | Vim: Out-of-bounds Read in Terminal Screen Snapshot | UNKNOWN | — | 23%ile | Microsoft | 2026-06-09 |
| CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | UNKNOWN | — | 30%ile | Microsoft | 2026-05-12 |