175970 matches found
CVE-2026-65200
The openUBMC device-management process is vulnerable to an out-of-bounds heap read due to an integer underflow. Three response parsers within the shared transport libraries fail to perform a lower-bound check when subtracting a fixed header or reserved-field size from a device-supplied response l...
CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...
CVE-2026-109950
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...
CVE-2026-109951
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...
DEBIAN-CVE-2026-109677
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...
CVE-2026-109677
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...
CVE-2026-77361
The obsidian-tc Model Context Protocol server (prior to version 1.3.1 ) contains a vulnerability where a mismatch between lexical vault-relative paths (used for ACL checks ) and resolved paths (used for containment checks) allows for ACL bypass . An attacker can use an out-of-band-planted symlink...
CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list ACL checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied...
CVE-2026-77362
Prior to version 1.3.1 , the obsidian-tc Model Context Protocol server for Obsidian vaults fails to consistently apply the read access-control list (ACL) to all returned fields. Specifically, the tasks_filter tool exposes group counts from denied notes, makemd_query passes unfiltered sibling resu...
Microsoft Windows Media Foundation Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally...
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
Windows Partition Management Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally...
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...
Role: DNS Server Information Disclosure Vulnerability
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network...