Search vulnerabilities

Expected end of text, found '/' (at char 48), (line:1, col:49)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-59608

Non-Heap Buffer Overflow in HEVC Decoder Allows Local Privilege Escalation

In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59611

Integer Overflow Leading to Remote Denial of Service in Android

In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59612

Non-Heap Buffer Overflow in Android AVC Decoder Allows Local Privilege Escalation

In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59613

Out‑of‑Bounds Read Leading to Remote Denial of Service on Android

In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59614

Missing permission check enables local disclosure of secure cache data on warm reset

In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59616

Local Privilege Escalation via Non-Heap Buffer Overflow in Android hwcodec_firmware

In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59619

Out-of-Bounds Read in Android AV1 Encoder Leading to Local Information Disclosure

In getCodecQp of GC2AV1Enc.cpp, there is a possible way to trigger an out of bounds read during quantization table lookup due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59623

Android SIP Bound Check Failure Enables Remote Denial of Service

In CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59626

Use‑After‑Free Causing Remote Privilege Escalation in Android UssiController

In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59628

Out-of-Bounds Read in Android Video Decoder Leading to Local Information Disclosure

In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 4.0 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59630

Android Security Policy Downgrade Enables Local Privilege Escalation

In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59631

Non‑Heap Buffer Overflow in HEVC Decoder Enables Local Privilege Escalation

In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59632

Memory Exhaustion via Undrained Message Queue in Android Messaging Controller

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue due to a type confusion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59635

Android AVC Decoder Non-Heap Buffer Overflow Leading to Local Privilege Escalation

In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59636

Premature Anti‑Rollback Fuse Update Enables Permanent Local Denial of Service on Android Devices

In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107398

Indico: Local file disclosure through offline-copy path traversal

Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Indico
Products
Indico
CVE-2026-128080

OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.

CVSS 3.1 · 5.8 Medium EPSS n/a KEV · Not listed
Vendors
Opentelemetry
Products
Opentelemetry-js
CVE-2026-128081

AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Luckypennysoftware
Products
Automapper
CVE-2026-62975

BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-62976

BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack