Lucene search
+L

59698 matches found

EUVD
EUVD
added 2026/09/04 3:13 p.m.7 views

EUVD-2026-71249

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

5.3AI score0.00195EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/04 3:13 p.m.8 views

CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

5.6AI score
SaveExploits0References12
EUVD
EUVD
added 2026/09/04 3:13 p.m.10 views

EUVD-2026-71245

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

5.5AI score0.00168EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/04 3:13 p.m.18 views

CVE-2026-80810 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

5.8AI score
SaveExploits0References7
CVE
CVE
added 2026/09/04 3:13 p.m.31 views

CVE-2026-80810

CVE-2026-80810 is an out-of-bounds write/read vulnerability in the Linux kernel's io_uring resource management subsystem. The root cause is an integer overflow in io_vec_fill_bvec(), which computes the folio size using a plain int 1 shifted by imu->folio_shift. When folio_shift is 32 or greate...

5.5AI score0.00168EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/04 3:12 p.m.11 views

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

5.7AI score
SaveExploits0References7
NVD
NVD
added 2026/09/04 10:17 a.m.7 views

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS0.00271EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/04 10:17 a.m.7 views

DEBIAN-CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.8AI score0.00271EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 10:17 a.m.4 views

UBUNTU-CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.8AI score0.00271EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/09/04 10:17 a.m.5 views

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.7AI score0.00271EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 9:46 a.m.45 views

CVE-2026-81666 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS0.00271EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 9:46 a.m.12 views

EUVD-2026-70987

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.3AI score0.00271EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/04 9:46 a.m.27 views

CVE-2026-81666

CVE-2026-81666 affects the Corosync cluster communication library. The vulnerability resides in the check_memb_commit_token_sanity function, where an integer overflow in the expected message-length calculation on 32-bit systems bypasses the length-validation check for membership commit token mess...

6.5CVSS5.3AI score0.00271EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/09/04 9:46 a.m.16 views

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.5AI score0.00271EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/09/04 9:46 a.m.7 views

CVE-2026-81666 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.8AI score0.00271EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/04 9:46 a.m.11 views

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

6.5CVSS5.5AI score0.00271EPSS
SaveExploits0References3
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/04 5:20 a.m.13 views

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by IBM Tivoli System Automation for Multiplatforms. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the...

9.8CVSS6.1AI score0.00463EPSS
SaveExploits1Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/09/04 12:00 a.m.7 views

The vulnerability of the fastrpc_get_args() function in the drivers/misc/fastrpc.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fastrpcgetargs function in the drivers/misc/fastrpc.c module of the Linux kernel is related to the possibility of integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

8.8CVSS4.4AI score0.00176EPSS
SaveExploits0References12Affected Software2
BDU FSTEC
BDU FSTEC
added 2026/09/04 12:00 a.m.9 views

The vulnerability of the `komeda_fb_afbc_size_check()` function in the `drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c` file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a hacker to access protected information or cause a service failure.

The vulnerability of the komedafbafbcsizecheck function in the drivers/gpu/drm/arm/display/komeda/komedaframebuffer.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux kernel, is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability...

7.1CVSS4.4AI score0.00117EPSS
SaveExploits0References13Affected Software2
BDU FSTEC
BDU FSTEC
added 2026/09/04 12:00 a.m.7 views

The vulnerability of the dma_length() function in the drivers/accel/ethosu/ethosu_gem.c module of the Linux kernel’s acceleration device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dmalength function in the drivers/accel/ethosu/ethosugem.c module of the Linux kernel’s acceleration device driver lies in integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

8.8CVSS5.4AI score0.00175EPSS
SaveExploits0References6Affected Software2
Rows per page
Query Builder