CVE-2026-82118 is a critical stack-based buffer overflow vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. It affects versions from 10-00 up to but not including 10-12-01, and multiple 9.x versions as specified. The vulnerability allows an attacker to execute arbitrary code or cause denial of service due to the buffer overflow. A fix is available in version 10-12-01.
CVE-2026-82122 is a critical stack-based buffer overflow vulnerability affecting Hitachi HiRDB Server Version 10 and several versions of Version 9. The flaw allows an attacker to execute code remotely without privileges or user interaction, potentially leading to high confidentiality and integrity impact, and some availability impact. The issue is fixed in HiRDB Server Version 10-12-01.
CVE-2026-76936 is a critical stack-based buffer overflow vulnerability in Hitachi's JP1/Automatic Job Management System 3 - Manager affecting versions from 10-00 up to but not including 13-50-31. The flaw allows an attacker to execute code remotely without privileges or user interaction, impacting confidentiality, integrity, and availability. A fix is available in version 13-50-31.
CVE-2026-76935 is a critical stack-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager affecting versions from 13-10 up to but not including 13-50-31. This flaw allows an attacker to execute arbitrary code with high impact on confidentiality and integrity, and a low impact on availability. The vulnerability has been fixed in version 13-50-31.
CVE-2026-76934 is a critical stack-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 11-00 up to but not including 13-50-31. The flaw allows an attacker to execute arbitrary code or cause denial of service due to memory corruption. A fix is available in version 13-50-31.
CVE-2026-76932 is a critical stack-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 10-00 up to but not including 13-50-31. The vulnerability allows an unauthenticated attacker to execute code remotely with high impact on confidentiality and integrity, and a low impact on availability. A fix is available in version 13-50-31.
CVE-2026-86575 is a critical stack-based buffer overflow vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System 3, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows an unauthenticated attacker to execute arbitrary code with high impact on confidentiality and integrity, and a low impact on availability. Fixed versions are available for all affected products.
CVE-2026-115863 is a stack-based buffer overflow vulnerability in ConnMan through version 2.0. It arises from improper handling of the DHCPv6 DOMAIN_LIST option in the get_domains function, where a fixed-size buffer is overflowed by copying up to 1025 bytes without validating the actual option length. An attacker on the same network can exploit this by sending a crafted Router Advertisement and DHCPv6 Reply message, causing connmand (running as root) to crash.
A critical stack-based buffer overflow vulnerability exists in the odhcpd DHCPv6 IA response handler used by OpenWrt. Versions prior to 25.12 are affected. The flaw allows writing beyond a fixed 512-byte stack buffer when processing DHCPv6 REQUEST packets with many IA options. This can be triggered remotely via unauthenticated UDP packets. The odhcpd daemon runs as root, and many embedded targets lack typical memory protections, making code execution feasible. The issue has been fixed in OpenWrt version 25.12.
CVE-2026-96185 is a stack-based buffer overflow vulnerability in Microsoft Exchange Online that allows an authorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 7.5. An official fix is available from Microsoft.
CVE-2026-85079 is a stack-based buffer overflow vulnerability in Silicon Labs EmberZNet versions 9.1.1 and earlier. It occurs when a malformed Simple_Desc_req response is processed, leading to an out-of-bounds write. Exploitation requires the response to come from a device already joined to the network and the attacker must wait for a Simple_Desc_req before launching the attack. The vulnerability has a high severity with a CVSS 4.0 score of 7.5.
A stack-based buffer overflow vulnerability exists in Silicon Labs EmberZNet versions 9.1.1 and earlier. It is triggered by a malformed Publish Price Matrix command sent from a device that has already joined the network. This vulnerability affects only devices supporting the Price Cluster and can potentially lead to remote code execution.
A stack-based buffer overflow vulnerability exists in Silicon Labs EmberZNet versions 9.1.1 and earlier. This flaw is triggered by a malformed GetGroupMembership message sent from a device that has already joined the network and supports the Group Cluster. The vulnerability can cause an out-of-bounds write leading to a crash. No remote code execution path has been observed due to limited values being writable.
CVE-2026-92183 is a stack-based buffer overflow vulnerability in GIMP version 3.2.2 related to the parsing of APNG files. It allows remote attackers to execute arbitrary code if a user opens a malicious APNG file or visits a malicious page. Exploitation requires user interaction. The flaw arises from improper validation of user-supplied data length before copying to a stack buffer.
IBM Planning Analytics versions 2.0 and 2.1 contain a stack-based buffer overflow vulnerability due to improper bounds checking. This flaw allows an attacker with limited privileges to overflow a buffer and potentially execute arbitrary code on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.8.
IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 contain a stack-based buffer overflow vulnerability in the apnotify utility. This flaw arises from insufficient validation of user input, allowing potential code injection. The vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. No public exploits or patches are currently documented.
CVE-2026-28763 is a critical stack-based buffer overflow vulnerability in the boa formMapDelDevice hostname functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to trigger this flaw, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-41223 is a critical stack-based buffer overflow vulnerability in the boa formMapDelDevice macstr functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to trigger this flaw, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-41222 is a critical stack-based buffer overflow vulnerability in the boa formParentControl URL functionality of the Totolink X2000R device (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). An authenticated attacker can send a specially crafted HTTP request to trigger this vulnerability, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-40615 is a critical stack-based buffer overflow vulnerability in the boa formParentControl deviceName functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to trigger this flaw, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability.