CVE Database

CVE-2026-76036 Critical · 9.6 CWE-122 Aug 18, 2026

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote...

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-76034 High · 8.8 CWE-122 Aug 18, 2026

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to...

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-71676 High · 7.5 CWE-122 Aug 18, 2026

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a…

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated

CVE-2026-67868 Critical · 9.8 CWE-122 Aug 17, 2026

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side…

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.

CVE-2026-68765 Medium · 6.1 CWE-122 Aug 17, 2026

hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations.

CVE-2026-72970 High · 8.3 CWE-122 Aug 14, 2026

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-19385 High · 8.8 CWE-122 Aug 13, 2026

PostgreSQL pg_dump heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14676 High · 8.8 CWE-122 Aug 13, 2026

PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

CVE-2026-14670 High · 8.8 CWE-122 Aug 13, 2026

PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14669 High · 8.8 CWE-122 Aug 13, 2026

PostgreSQL to_char heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14664 High · 8.8 CWE-122 Aug 13, 2026

PostgreSQL regexp heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-18368 Medium · 6.0 CWE-122 Aug 13, 2026

Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service.

CVE-2026-19694 Medium · 5.5 CWE-122 Aug 13, 2026

Heap-based Buffer Overflow in Wireshark

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service

CVE-2026-19004 High · 8.1 CWE-122 Aug 12, 2026

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

CVE-2026-73242 Critical · 9.1 CWE-122 Aug 11, 2026

FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

CVE-2026-71331 High · 8.1 CWE-122 Aug 11, 2026

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

CVE-2026-70347 High · 7.8 CWE-122 Aug 11, 2026

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-70345 High · 7.8 CWE-122 Aug 11, 2026

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-70330 High · 7.8 CWE-122 Aug 11, 2026

Windows DNS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-70304 High · 7.8 CWE-122 Aug 11, 2026

Windows DNS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-70130 High · 7.8 CWE-122 Aug 11, 2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-68815 High · 7.8 CWE-122 Aug 11, 2026

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-68812 High · 7.8 CWE-122 Aug 11, 2026

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-68807 High · 7.8 CWE-122 Aug 11, 2026

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-68805 High · 7.8 CWE-122 Aug 11, 2026

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.