697 matches found
CVE-2026-64531
CVE-2026-64531 — OVSwrap Linux kernel Open vSwitch module local privilege escalation normal user → root PoC. Exploits the integer wraparound of the 16-bit nlalen field to escalate from a normal user all the way to root. Vulnerability Summary When the nested action stream generated by OVS exceeds...
CVE-2026-38427
CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...
CVE-2026-114645
A flaw was found in mongo-c-driver. An integer wraparound in the Windows-native Kerberos authentication code can occur when an excessively long credential value is supplied in the client connection configuration. An attacker capable of modifying this client configuration can cause the driver to...
CVE-2026-114645
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
CVE-2026-114645
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
CVE-2026-114645 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
CVE-2026-114645
The MongoDB C Driver is vulnerable to a heap buffer overflow in its Windows-only Kerberos/SSPI authentication code. A 32-bit integer wraparound occurs when an excessively long credential value is provided in the client's connection configuration, leading to the allocation of an undersized heap bu...
CVE-2026-114645 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
EUVD-2026-108307
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
PT-2026-121516
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...
CVE-2026-114045
A flaw was found in FreeRDP. An integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDCFORMATS PDUs, causing an unbounded heap write during server audio playback that may...
DEBIAN-CVE-2026-114045
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for...
CVE-2026-114045
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for...
CVE-2026-114045 FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for...
EUVD-2026-106996
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for...
CVE-2026-114045
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for...
PT-2026-120171
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd server select format DVI ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC FORMATS PDUs with an nBlockAlign too small...
Linux Distros Unpatched Vulnerability : CVE-2026-114045
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat DVIADPCM...
Linux Distros Unpatched Vulnerability : CVE-2026-109448
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, t...
OESA-2026-4355 mongo-c-driver security update
mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: A weakness in the MongoDB C Driver allows special elements in...