CWE-191 (CWE-191) — 94 disclosed vulnerabilities

Records the NVD classes under CWE-191, highest CVSS first.

CRITICAL 9.8CVE-2026-49868public PoC2026-10-16
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and I…
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-1019802026-10-14
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-858062026-10-13
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-838692026-10-13
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-835782026-10-13
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-1002222026-10-13
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.8CVE-2026-84411public PoC2026-10-02
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution a…
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-977462026-10-13
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-977392026-10-13
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-970042026-10-13
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-853392026-10-13
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
AI risk analysis on Exploit-DB.ai →
HIGH 8.6CVE-2026-1118082026-10-21
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Us…
AI risk analysis on Exploit-DB.ai →
HIGH 8.3CVE-2026-703882026-10-26
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length valu…
AI risk analysis on Exploit-DB.ai →
HIGH 8.2CVE-2026-116788public PoC2026-11-05
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent …
AI risk analysis on Exploit-DB.ai →
HIGH 8.2CVE-2026-1020732026-10-13
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions <…
AI risk analysis on Exploit-DB.ai →
HIGH 8.1CVE-2026-19186public PoC2026-10-07
ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes long. All three var…
AI risk analysis on Exploit-DB.ai →
HIGH 8CVE-2026-968442026-10-13
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
AI risk analysis on Exploit-DB.ai →
HIGH 8CVE-2026-838382026-10-13
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
AI risk analysis on Exploit-DB.ai →
HIGH 7.8CVE-2026-838362026-10-13
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
AI risk analysis on Exploit-DB.ai →
HIGH 7.8CVE-2026-700642026-10-13
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
AI risk analysis on Exploit-DB.ai →
HIGH 7.8CVE-2026-47585public PoC2026-09-30
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, inform…
AI risk analysis on Exploit-DB.ai →
HIGH 7.8CVE-2026-47540public PoC2026-09-30
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of priv…
AI risk analysis on Exploit-DB.ai →
HIGH 7.6CVE-2026-111881public PoC2026-10-17
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by cl…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-125404public PoC2026-11-10
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to o…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-123571public PoC2026-11-08
Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtr…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-116569public PoC2026-11-05
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-116568public PoC2026-11-05
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inboun…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-115928public PoC2026-11-05
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and sa…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-121727public PoC2026-11-03
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-120058public PoC2026-11-02
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more colu…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-117068public PoC2026-11-02
An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Ide…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-563862026-10-21
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Caus…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-48503public PoC2026-10-16
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-73252public PoC2026-10-14
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentTy…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-838552026-10-13
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-1021922026-10-13
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-582492026-10-13
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the …
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-1077942026-10-10
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory ex…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2013-10076public PoC2026-10-10
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory …
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-103636public PoC2026-10-10
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized …
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-75352public PoC2026-10-09
OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-88376public PoC2026-09-24
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calc…
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-890282026-09-16
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can …
AI risk analysis on Exploit-DB.ai →
HIGH 7.5CVE-2026-71202public PoC2026-08-05
The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.
AI risk analysis on Exploit-DB.ai →
HIGH 7.1CVE-2026-1034112026-10-28
An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.
AI risk analysis on Exploit-DB.ai →
HIGH 7.1CVE-2026-829472026-10-26
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them a…
AI risk analysis on Exploit-DB.ai →
HIGH 7CVE-2026-836762026-10-13
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.8CVE-2026-18747public PoC2026-09-29
The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/s…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.7CVE-2026-205762026-11-02
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.7CVE-2026-205722026-11-02
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS1143144…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.7CVE-2026-881432026-10-13
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-865662026-10-14
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-1019382026-10-14
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated w…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-110714public PoC2026-10-14
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an A…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-881952026-10-13
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-888332026-10-13
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow …
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-53922public PoC2026-10-12
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted REN…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-109246public PoC2026-10-12
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underf…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-1064292026-10-08
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an a…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-1021682026-10-06
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the …
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-240772026-08-04
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
aqt1000 firmware · aqt1000 · ar8035 firmware · ar8035 · csra6620 firmware · csra6620
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.3CVE-2026-94090public PoC2026-09-20
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.2CVE-2026-1064372026-10-08
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who ca…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.2CVE-2026-88377public PoC2026-09-24
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom:…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.1CVE-2026-125197public PoC2026-11-09
FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL vide…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.1CVE-2026-1076142026-10-08
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or hei…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.9CVE-2026-120060public PoC2026-11-02
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.9CVE-2026-75083public PoC2026-10-14
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler …
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.5CVE-2026-112010public PoC2026-10-18
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rw…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.5CVE-2026-969252026-10-13
Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.5CVE-2026-107635public PoC2026-10-08
Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datum_size smaller…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.4CVE-2026-1019682026-10-14
An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast joi…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.3CVE-2026-502162026-10-14
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, …
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.2CVE-2026-61497public PoC2026-11-03
TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item …
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.1CVE-2026-175042026-09-24
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a…
power system s1122 \(9824-22a\) firmware · power system s1122 \(9824-22a\) · power system s1124 \(9824-42a\) firmware · power system s1124 \(9824-42a\) · power system s1122s \(9824-22b\) firmware · power system s1122s \(9824-22b\)
AI risk analysis on Exploit-DB.ai →
LOW 3.5CVE-2026-652002026-10-13
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length wi…
AI risk analysis on Exploit-DB.ai →
LOW 3.5CVE-2026-582422026-10-13
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the att…
AI risk analysis on Exploit-DB.ai →
LOW 3.3CVE-2026-95958public PoC2026-09-23
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. Performing a manipulation of the argument BlockSize results in integer underflow. The attac…
AI risk analysis on Exploit-DB.ai →
LOW 3.3CVE-2026-81881public PoC2026-09-22
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtra…
radare2
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-803032026-11-06
An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-122992public PoC2026-11-05
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-1117352026-10-29
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, …
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-747552026-10-21
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function com…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-111075public PoC2026-10-21
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote atta…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-92853public PoC2026-10-20
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, wh…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-106464public PoC2026-10-14
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-889642026-10-13
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-107836public PoC2026-10-09
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Bl…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-83742public PoC2026-10-07
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-865372026-10-02
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to ve…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-824592026-10-02
Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-861332026-09-30
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-861322026-09-30
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-102714public PoC2026-09-29
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the f…
AI risk analysis on Exploit-DB.ai →