EUVD-2026-116886

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-84730

Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more...

EUVD-2026-116688

Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more...

CVE-2026-84730

Certain ASUS Router firmware versions are vulnerable to a stack-based buffer overflow (CWE-121) within the AiCloud Feature . An unauthenticated nearby attacker can exploit this by providing a crafted device name to execute arbitrary commands with root privileges . For remediation, users should re...

CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The...

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-57191

A flaw was found in Asterisk. An unbounded string parsing vulnerability in the respjsippubsub module allows an unauthenticated remote attacker to trigger a stack-based buffer overflow by sending a specially crafted Message Waiting Indication MWI NOTIFY packet. Successful exploitation leads to a...

EUVD-2026-115640

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

DEBIAN-CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120752

A flaw was found in PyMuPDF. An attacker who controls input passed to the free text annotation feature can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS by crashing the application. This issue is caused by copying caller-supplied callout points into a...

DEBIAN-CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-29508

A flaw was found in minidlna. This vulnerability allows a remote attacker to achieve arbitrary code execution or cause a Denial of Service DoS by placing a specially crafted DFF audio file into a directory monitored by the service. When processing the file, the application fails to validate an...

EUVD-2026-115624

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-120067

A flaw was found in postgresql-odbc. When processing updatable database queries, the driver copies internal row metadata into a fixed-size memory buffer without verifying the data length sent by the server. A malicious database server or an untrusted user capable of creating custom database views...

CVE-2026-120061

A flaw was found in postgresql-odbc. When processing Open Database Connectivity ODBC escape sequences in SQL statements, the parser fails to properly validate buffer boundaries. An attacker capable of submitting untrusted SQL text to an application using the driver can trigger a stack-based buffe...

CVE-2026-106808

OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...

SUSE CVE-2026-120252

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decodejpegsof3. Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack...

CVE-2026-106803

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsregistrarpcscf module. When processing a crafted application/reginfo+xml NOTIFY message, processcontact copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validatin...