Monthly
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.
Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a serious but not imminently weaponized code-execution vulnerability.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.
Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a serious but not imminently weaponized code-execution vulnerability.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.