The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to…

▾ Sunlitcanva · affinityEPSS 0.10%via NVD

CVE-2026-101130Low· 3.6

3w ago

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an A…

▾ Sunlitcanva · affinityEPSS 0.10%via NVD

CVE-2026-101094Low· 3.6

3w ago

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could cr…

CWE-126

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.

Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to…

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

In Modem, there is a possible out of bounds read due to a missing bounds check

In Modem, there is a possible out of bounds read due to a missing permission check

In Modem, there is a possible out of bounds read due to a missing bounds check

In Modem, there is a possible out of bounds read due to a missing permission check

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data

Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when t…

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Information Disclosure when a pointer is reused after being deallocated.

Transient DOS while parsing frame during channel usage.

A vulnerability was found in GPAC up to f1219cde

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and mod…

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.