401609 matches found
CVE-2026-75619 RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RT...
CVE-2026-75619 RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RT...
CVE-2026-75619
TP-Link Tapo C100/C101 V5 contains a heap-based buffer overflow in the RTSP service . An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, causing out-of-bounds heap writes. Successful exploitation crashes the RTSP service a...
CVE-2026-17093 Power System Buffer Overflow
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level acce...
CVE-2026-17093 Power System Buffer Overflow
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level acce...
CVE-2026-17093
IBM Power Systems firmware (FW950, FW1060, FW1110, FW1120, OP940) is vulnerable to CWE-121 stack-based buffer overflow in host firmware configuration parsing. An attacker with BMC/FSP service-level access can compromise the host firmware boot stage and everything subsequently loaded, with CVSS 8....
CVE-2026-74469
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. An integer overflow occurs when the transportcount for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer address...
CVE-2026-19321
IBM Power Firmware is vulnerable due to CWE-190: Integer Overflow or Wraparound in host firmware. An attacker with service-processor access can craft commands to leak inaccessible hardware registers, causing limited confidentiality and high availability impact (CVSS 6.7). Affected versions includ...
CVE-2026-19321 Power System Integer Overflow
Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers th...
CVE-2026-74559
A flaw was found in the Linux kernel's AFXDP eXpress Data Path networking component. This vulnerability, located in the xskbuildskb function, involves improper handling of network packet descriptors. When processing large or malformed multi-buffer packets, the system fails to properly drain...
CVE-2026-72478
A flaw was found in the Linux kernel's NTFS3 file system driver. The rungethighestvcn function, which processes NTFS mapping-pairs buffers, does not properly validate buffer boundaries. A crafted NTFS log file, when mounted, can cause the system to read beyond its allocated memory. This memory...
CVE-2026-63633
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
DEBIAN-CVE-2026-63633
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
UBUNTU-CVE-2026-63633
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
UBUNTU-CVE-2026-63652
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...
CVE-2026-55648
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...
CVE-2026-55194
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...
CVE-2026-55191
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...
CVE-2026-55193
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...
