CWE-122
CVEs classified under CWE-122, newest first.
1448 CVEsRSS
CVE-2026-108441High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108439High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108444High· 8.8Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVE-2026-108448High· 7.5Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-108447High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108451High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108450High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108449High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-55246High· 7.8PoCbincookie is a header-only binarycookies parser
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byt…
CVE-2026-110958Critical· 10.0PoCA vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The ex…
CVE-2026-79831Medium· 6.6A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
CVE-2026-79828High· 7.1A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79825High· 7.1A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79826High· 7.1A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
CVE-2026-79827High· 7.1A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79822High· 7.1A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
CVE-2026-101307High· 8.2When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples in…
CVE-2026-110837High· 7.1PoCFreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A ma…
CVE-2026-63626High· 8.8Mongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_T…
CVE-2026-103994High· 8.8A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code exe…
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code exe…
CVE-2026-102175Critical· 9.8A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connec…
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connec…
CVE-2026-102015High· 8.8A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an …
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an …
CVE-2026-101950Critical· 9.8A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity v…
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity v…
CVE-2026-101927High· 7.8A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via …
A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via …
CVE-2026-93479High· 8.1A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alte…
CVE-2026-15176High· 8.1A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the sam…
CVE-2026-73791Low· 2.0A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
CVE-2026-110166High· 8.8Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110155High· 8.8Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110152Critical· 9.6PoCBuffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)