Base de CVEs

CVE-2016-20039 Alta · 8.4 CWE-787 28/03/2026

Multi Emulator Super System 0.154-3.1 Buffer Overflow

Multi Emulator Super System 0.154-3.1 contains a buffer overflow vulnerability in the gamma parameter handling that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized gamma parameter value to overflow the stack buffer and overwrite the instruction pointer with a controlled address to achieve code execution.

CVE-2016-20038 Alta · 8.4 CWE-787 28/03/2026

yTree 1.94-1.1 Stack-Based Buffer Overflow

yTree 1.94-1.1 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an excessively long argument to the application. Attackers can craft a malicious command-line argument containing shellcode and a return address to overwrite the stack and execute code in the application context.

CVE-2016-20037 Alta · 8.4 CWE-787 28/03/2026

xwpe 1.5.30a-2.1 Stack-based Buffer Overflow

xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long input strings that exceed buffer boundaries. Attackers can craft malicious command-line arguments with 262 bytes of junk data followed by shellcode to overwrite the instruction pointer and achieve code execution or denial of service.

CVE-2026-4975 Alta · 8.8 CWE-787 27/03/2026

Tenda AC15 POST Request setcfm formSetCfm memory corruption

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-4974 Alta · 8.8 CWE-787 27/03/2026

Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVE-2026-4961 Alta · 8.8 CWE-787 27/03/2026

Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

CVE-2026-4960 Alta · 8.8 CWE-787 27/03/2026

Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-27880 Alta · 7.5 CWE-787 27/03/2026

OpenFeature evaluation API reads input data with no bounds

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

CVE-2026-27879 Média · 6.5 CWE-787 27/03/2026

Query resampling can cause unbounded memory allocations

A resample query can be used to trigger out-of-memory crashes in Grafana.

CVE-2026-4906 Alta · 8.8 CWE-787 26/03/2026

Tenda AC5 POST Request WizardHandle decodePwd stack-based overflow

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-33721 Alta · 7.5 CWE-787 26/03/2026

MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

CVE-2026-4905 Alta · 8.8 CWE-787 26/03/2026

Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflow

A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsOOB of the component POST Request Handler. Performing a manipulation of the argument index results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVE-2026-4904 Alta · 8.8 CWE-787 26/03/2026

Tenda AC5 POST Request setcfm formSetCfm stack-based overflow

A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-4903 Alta · 8.8 CWE-787 26/03/2026

Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.

CVE-2026-4902 Alta · 8.8 CWE-787 26/03/2026

Tenda AC5 POST Request addressNat fromAddressNat memory corruption

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

CVE-2026-33535 Média · 5.5 CWE-787 26/03/2026

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, an out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

CVE-2026-27816 Crítica · 9.1 CWE-787 26/03/2026

Escrita fora dos limites no update_energy_transfer_modes do ISO15118 do EVerest

O EVerest é uma pilha de software para recarga de veículos elétricos. Antes das versões até 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copia uma lista de tamanho variável para um array de tamanho fixo 6 sem verificação de limites. Com a validação de esquema desativada por padrão, cargas MQTT Cmd superdimensionadas podem provocar escritas fora dos limites, corromper o estado adjacente do EVSE ou travar o processo. A versão 2026.02.0 contém uma correção.

CVE-2026-27815 Crítica · 9.1 CWE-787 26/03/2026

EVerest: escrita fora dos limites em payment_options do session_setup ISO15118

O EVerest é uma pilha de software para recarga de veículos elétricos. Antes da versão 2026.02.0, ISO15118_chargerImpl::handle_session_setup copia uma lista payment_options de tamanho variável para um array de tamanho fixo igual a 2, sem verificação de limites. Com a validação de schema desativada por padrão, payloads MQTT Cmd superdimensionados podem causar escritas fora dos limites, corromper o estado adjacente do EVSE ou derrubar o processo. A versão 2026.02.0 contém uma correção (patch).

CVE-2026-26073 Média · 5.9 CWE-787 26/03/2026

EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/`std::deque` corruption. The trigger is powermeter public key update and EV session/error events (while OCPP not started). This results in a TSAN data race report and an ASAN/UBSAN misaligned address runtime error being observed. Version 2026.02.0 contains a patch.

CVE-2026-27664 Alta · 7.5 CWE-787 26/03/2026

Out-of-bounds Write em Siemens CPCI85 Central Processing/Communication

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < V26.10.0). The affected application contains an out-of-bounds write vulnerability while parsing specially crafted XML inputs. This could allow an unauthenticated attacker to exploit this issue by sending a malicious XML request, which may cause the service to crash, resulting in a denial-of-service condition.

CVE-2019-25650 Alta · 8.4 CWE-787 26/03/2026

River Past CamDo 3.7.6 Structured Exception Handler Buffer Overflow

River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_enc.dll name field. Attackers can craft a payload with a 280-byte buffer, NSEH jump instruction, and SEH handler address pointing to a pop-pop-ret gadget to trigger code execution and establish a bind shell on port 3110.

CVE-2019-25649 Média · 5.5 CWE-787 26/03/2026

River Past Audio Converter 7.7.16 Local Buffer Overflow DoS

River Past Audio Converter 7.7.16 contains a local buffer overflow vulnerability in the activation code field that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a large payload of repeated characters into the 'E-Mail and Activation Code' field and click 'Activate' to trigger a denial of service condition.

CVE-2019-25648 Média · 6.2 CWE-787 26/03/2026

MyVideoConverter Pro 3.14 Denial of Service Buffer Overflow

MyVideoConverter Pro 3.14 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string to the registration code input field. Attackers can paste a malicious payload containing 10000 bytes into the 'Copy and Paste Registration Code' field to trigger a denial of service condition.

CVE-2018-25219 Alta · 7.8 CWE-787 26/03/2026

PassFab Excel Password Recovery 8.3.1 SEH Buffer Overflow

PassFab Excel Password Recovery 8.3.1 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the registration code field. Attackers can craft a buffer overflow payload with a pop-pop-ret gadget and shellcode that triggers code execution when pasted into the Licensed E-mail and Registration Code field during the registration process.

CVE-2018-25218 Alta · 7.8 CWE-787 26/03/2026

PassFab RAR Password Recovery 9.3.2 SEH Buffer Overflow

PassFab RAR Password Recovery 9.3.2 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload. Attackers can craft a payload with a buffer overflow, NSEH jump, and shellcode, then paste it into the 'Licensed E-mail and Registration Code' field during registration to trigger code execution.