101670 matches found
CVE-2026-102174: Stack-based Buffer Overflow
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS...
CVE-2026-102014: Stack-based Buffer Overflow
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...
CVE-2026-73795: Stack-based Buffer Overflow
A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service...
PT-2026-114194
🚨 CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP...
CVE-2026-101981: Stack-based Buffer Overflow
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message...
CVE-2026-98413
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...
PT-2026-114198
🚨 CVE-2026-33798 A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. 🎖@cveNotify...
Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130116)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130116 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Tenable has extracted the preceding description...
Copeland XWEB and XWEB Pro Stack-Based Buffer Overflow (CVE-2026-20797)
A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Adobe Substance 3D Stager 3.0.0 < 3.1.9 Multiple Vulnerabilities (APSB26-170)
The version of Adobe Substance 3D Stager installed on the remote Windows host is prior to 3.1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-170 advisory. - Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary cod...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libxml2 (UTSA-2026-130053)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130053 advisory. In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. Tenable has extracted the preceding description block directly fro...
Adobe Dimension < 4.1.9 Multiple Vulnerabilities (APSB26-171) (macOS)
The version of Adobe Dimension installed on the remote macOS host is prior to 4.1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-171 advisory. - Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executio...
RockyLinux 9 : libreoffice (RLSA-2026:82013)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82013 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...
PT-2026-113897
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and...
CVE-2026-101337: Stack-based Buffer Overflow
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
CVE-2026-101338: Stack-based Buffer Overflow
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...
PT-2026-114100
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221 lib.c, whose bit reader refills without checking the data u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode vector quantized mlt indices past the stack...
CVE-2026-109438: Use of Uninitialized Resource
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...
Linux Distros Unpatched Vulnerability : CVE-2026-98413
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for...
