Lucene search
+L

23414 matches found

UbuntuCve
UbuntuCve
•added 2026/09/11 8:18 p.m.•15 views

CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

7.8CVSS6AI score0.00176EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
•added 2026/09/11 8:18 p.m.•12 views

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

7.8CVSS5.9AI score0.00175EPSS
SaveExploits0References5
OSV
OSV
•added 2026/09/11 8:18 p.m.•7 views

UBUNTU-CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

7.8CVSS6.1AI score0.00175EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/11 8:17 p.m.•8 views

CVE-2026-54135

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

7.5CVSS0.00761EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/11 7:46 p.m.•32 views

CVE-2026-89743 misc: nsm: bound the device-reported response length

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

7.7CVSS0.0019EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/11 7:46 p.m.•18 views

CVE-2026-89743 misc: nsm: bound the device-reported response length

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

7.7CVSS6.2AI score
SaveExploits0References7
Debian CVE
Debian CVE
•added 2026/09/11 7:46 p.m.•14 views

CVE-2026-89743

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

7.7CVSS6.2AI score0.0019EPSS
SaveExploits0
CVE
CVE
•added 2026/09/11 7:46 p.m.•22 views

CVE-2026-89743

A vulnerability in the Linux kernel's NSM (Network Shared Memory) driver allows a malicious or buggy backend to report a response length larger than the allocated buffer. The function nsm_sendrecv_msg_locked() stores the virtqueue used-ring length without bounding it, so parse_resp_raw() copies e...

7.7CVSS6AI score0.0019EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/11 7:46 p.m.•9 views

EUVD-2026-76632

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...

6AI score0.0019EPSS
SaveExploits0References4
Debian CVE
Debian CVE
•added 2026/09/11 7:46 p.m.•15 views

CVE-2026-89720

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...

7.7CVSS6.1AI score0.0019EPSS
SaveExploits0
EUVD
EUVD
•added 2026/09/11 7:45 p.m.•10 views

EUVD-2026-76540

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

6AI score0.0022EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/11 7:45 p.m.•13 views

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

6.1AI score
SaveExploits0References11
CVE
CVE
•added 2026/09/11 7:44 p.m.•30 views

CVE-2026-89588

CVE-2026-89588 is a Linux kernel vulnerability in the ACPI APEI GHES (Generic Hardware Error Source) component, specifically in ghes_handle_arm_hw_error(). After skipping the cper_sec_proc_arm header via pointer arithmetic (err + 1), the remaining buffer length was incorrectly reduced by sizeof(e...

8.4CVSS5.8AI score0.00196EPSS
SaveExploits0References4
Debian CVE
Debian CVE
•added 2026/09/11 7:44 p.m.•18 views

CVE-2026-89588

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

8.4CVSS5.9AI score0.00196EPSS
SaveExploits0
OSV
OSV
•added 2026/09/11 7:44 p.m.•9 views

CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

8.4CVSS5.9AI score
SaveExploits0References7
Cvelist
Cvelist
•added 2026/09/11 7:44 p.m.•28 views

CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

8.4CVSS0.00196EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/09/11 7:44 p.m.•5 views

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

7.5CVSS5.9AI score0.00761EPSS
SaveExploits0References3
CVE
CVE
•added 2026/09/11 7:44 p.m.•20 views

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

7.5CVSS5.9AI score0.00761EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/11 7:44 p.m.•27 views

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

7.5CVSS0.00761EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/11 7:44 p.m.•7 views

EUVD-2026-76482

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

7.5CVSS5.9AI score0.00761EPSS
SaveExploits0References3
Rows per page
Query Builder