Export limit exceeded: 48434 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48434 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66485 | 1 Gnu | 1 Cpio | 2026-08-10 | 5.0 Medium |
| GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 | ||||
| CVE-2026-71852 | 1 Py-pdf | 1 Pypdf | 2026-08-10 | 5.5 Medium |
| pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0. | ||||
| CVE-2026-71291 | 1 Bolt | 1 Core | 2026-08-10 | 8.8 High |
| Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing. | ||||
| CVE-2026-71286 | 1 Miguelcobain | 1 Ember-dynamic-render-template | 2026-08-10 | 6.1 Medium |
| The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. | ||||
| CVE-2026-71267 | 1 Rxi | 1 Microtar | 2026-08-10 | 9.8 Critical |
| microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. | ||||
| CVE-2026-71266 | 1 Syoyo | 1 Tinyobjloader-c | 2026-08-10 | 7.8 High |
| tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file. | ||||
| CVE-2026-71265 | 1 Domoticz | 1 Domoticz | 2026-08-10 | 7.5 High |
| Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). | ||||
| CVE-2026-71261 | 1 Mackron | 1 Dr Libs | 2026-08-10 | 7.8 High |
| dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. | ||||
| CVE-2026-71259 | 1 Esphome | 1 Esphome | 2026-08-10 | 8.6 High |
| ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively). | ||||
| CVE-2026-71256 | 1 Debevv | 1 Nanomodbus | 2026-08-10 | 9.8 Critical |
| nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. | ||||
| CVE-2026-71239 | 1 Djangocrm | 1 Django-crm | 2026-08-10 | 8.1 High |
| DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern. | ||||
| CVE-2026-71202 | 1 Kosinix | 1 Raster | 2026-08-10 | 7.5 High |
| The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. | ||||
| CVE-2026-70378 | 1 Theotherphil | 1 Imagecli | 2026-08-10 | 7.5 High |
| imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process. | ||||
| CVE-2026-55743 | 1 Tinyhumansai | 1 Openhuman | 2026-08-10 | 9.6 Critical |
| The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. | ||||
| CVE-2026-55738 | 1 Rxi | 1 Microtar | 2026-08-10 | 8.8 High |
| A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source. | ||||
| CVE-2026-54417 | 1 Rxi | 1 Microtar | 2026-08-10 | 7.5 High |
| An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic. | ||||
| CVE-2026-54413 | 1 Driftregion | 1 Iso14229 | 2026-08-10 | 8.2 High |
| driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. | ||||
| CVE-2026-54412 | 1 Liambindle | 1 Mqtt-c | 2026-08-10 | 8.2 High |
| LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. | ||||
| CVE-2026-54410 | 1 Debevv | 1 Nanomodbus | 2026-08-10 | 8.6 High |
| nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. | ||||
| CVE-2026-3945 | 1 Tinyproxy | 1 Tinyproxy | 2026-08-10 | 7.5 High |
| An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE). | ||||