CVE-2026-63626 is a heap-based buffer overflow vulnerability in the cesanta mongoose embedded web server and network library. The flaw exists in the ppp_handle_ipv6cp() function prior to version 7.23, where it improperly trusts the 16-bit IPv6CP length field without validating it against the actual payload size. This can allow an unauthenticated adjacent peer on a PPP or PPPoE link to send a malformed Configure-Request with an oversized length, leading to out-of-bounds reads and writes in memory buffers. The issue can also cause exposure of adjacent heap memory or hang the event loop. The vulnerability is fixed in version 7.23.
CVE-2026-102175 is a critical heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service by sending a crafted frame over the service-deployment TCP connection. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. No known exploits in the wild have been reported. The CVSS v3.1 score is 9.8, indicating a critical severity level.
CVE-2026-102015 is a heap-based buffer overflow vulnerability in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS 3.1 score is 8.8, indicating high severity.
CVE-2026-101927 is a heap-based buffer overflow vulnerability in the eventd component of Juniper Networks Junos OS and Junos OS Evolved across all platforms. It allows an unprivileged local attacker to cause denial of service or escalate privileges to root by sending crafted IPC event messages. The vulnerability has a high severity with a CVSS score of 7.8. Multiple versions of Junos OS and Junos OS Evolved are affected, including various release trains prior to specific patch releases. No explicit patch links are provided in the data, and no known exploits are reported in the wild.
CVE-2026-101950 is a critical heap-based buffer overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series devices. An unauthenticated network attacker can exploit this vulnerability by sending malformed IPv4 packets to an interface configured for Secure Vector Routing, potentially causing denial of service and compromising confidentiality and integrity.
CVE-2026-103994 is a heap-based buffer overflow vulnerability in the VXLAN Gateway Daemon (vgd) component of Juniper Networks Junos OS. It allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and potentially achieve remote code execution. The vulnerability has a high severity with a CVSS score of 8.8. Multiple versions of Junos OS prior to specific patch releases are affected.
CVE-2026-93479 is a heap-based buffer overflow vulnerability in F5 NGINX Plus and NGINX Open Source related to the use of map directives with regex matching combined with certain references to regex capture variables. An unauthenticated attacker can exploit this by sending crafted HTTP requests, potentially causing a denial-of-service or code execution on systems with ASLR disabled or bypassed. The vulnerability affects specific versions of NGINX Plus and Open Source and has been fixed in later releases.
CVE-2026-15176 is a heap-based buffer overflow vulnerability in F5 NGINX Plus and NGINX Open Source. It occurs when a location is configured using the alias directive combined with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. An unauthenticated attacker can exploit this by sending crafted HTTP requests, potentially causing the NGINX worker process to restart or enabling code execution if ASLR is disabled or bypassed. This vulnerability affects multiple versions of NGINX Plus and Open Source as specified. It is a data plane issue with no control plane exposure.
CVE-2026-73791 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop Hpjmeter. The flaw can cause both stack and heap buffer overflows. The CVSS score is low, indicating limited impact, with no confidentiality or integrity impact and only low impact on availability. There are no known exploits in the wild and no patch information is provided.
CVE-2026-94512 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker to execute code remotely over a network. The flaw affects multiple versions of SQL Server 2017 and later, with fixes released in specific updates. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability if exploited. No known exploits are reported in the wild at this time.
CVE-2026-88089 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) and related versions. It allows an authorized attacker with high privileges to execute code locally on the affected system. The vulnerability affects multiple versions of Microsoft SQL Server 2017 and later, with fixes available in specific updated releases. The CVSS 3.1 base score is 6.7, indicating a medium severity level. No known exploits in the wild have been reported. Microsoft has issued official fixes for the affected versions.
CVE-2026-88085 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized local attacker to elevate privileges. The flaw affects multiple versions of SQL Server 2017 and later branches before specific fixed releases. Microsoft has issued official fixes for all affected versions.
CVE-2026-85919 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2019 (GDR) that allows an authorized local attacker to elevate privileges. The flaw affects multiple versions of SQL Server 2019 and later branches. Microsoft has released official fixes for the affected versions to address this high-severity vulnerability.
CVE-2026-88082 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2019 (GDR) that allows an authorized local attacker to elevate privileges. The vulnerability affects multiple versions of SQL Server 2019 and later releases. Microsoft has released official fixes for all affected versions. The vulnerability has a high severity rating with a CVSS score of 7. No known exploits are reported in the wild.
CVE-2026-85886 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) and related versions. This flaw allows an authorized attacker with low privileges to execute code remotely over a network. The vulnerability affects multiple versions of Microsoft SQL Server 2017 and later, with official fixes released by Microsoft.
CVE-2026-83945 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2022 (GDR) that allows an authorized attacker to execute code remotely over a network. The flaw affects multiple versions of SQL Server 2022 and has been assigned a CVSS score of 6.6, indicating medium severity. Microsoft has released official patches to address this vulnerability.
CVE-2026-70189 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker with high privileges to execute code locally. The vulnerability affects multiple versions of SQL Server 2017 and later releases up to specific fixed versions. A patch is available from Microsoft to address this issue.
CVE-2026-68883 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker to elevate privileges over a network. The flaw affects multiple versions of SQL Server 2017 and later releases. Microsoft has released official fixes for all affected versions. The vulnerability has a high severity score of 8.5 and requires an attacker with low privileges but network access. No known exploits are reported in the wild at this time.
CVE-2026-67625 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) and later versions. This flaw allows an authorized attacker with low privileges to execute code remotely over a network. The vulnerability affects multiple versions of SQL Server 2017, 2019, 2022, and 2024 branches prior to specific fixed releases. A high-severity CVSS 3.1 score of 8.5 reflects the critical impact on confidentiality, integrity, and availability. Microsoft has issued official fixes for all affected versions.
Adobe Photoshop Desktop contains a heap-based buffer overflow vulnerability (CWE-122) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.