CWE-120: Buffer Overflow vulnerabilities

Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.

CVE-2026-6691 is a high-severity vulnerability in the MongoDB C Driver version 2.1.0. It involves unsafe string copying in the Cyrus SASL integration during username canonicalization, leading to a heap buffer overflow. This flaw can be triggered by passing untrusted input in the username field of a MongoDB URI when using the GSSAPI authentication mechanism. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.

A buffer overflow vulnerability exists in the K12 RF5 file parser of Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. This flaw can cause the application to crash, resulting in a denial of service.

CVE-2026-7057 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It exists in an unknown function within the /goform/setcfm endpoint of the httpd component. The vulnerability is triggered by manipulating the funcname or funcpara1 arguments remotely, potentially allowing an attacker to cause a buffer overflow. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

CVE-2026-7056 is a high-severity buffer overflow vulnerability in the Tenda F456 router version 1.0.0.5. It affects the fromSafeUrlFilter function in the /goform/SafeUrlFilter component of the httpd service. The vulnerability arises from improper handling of the 'page' argument, allowing remote attackers to cause a buffer overflow. Exploit code is publicly available, but no known exploits in the wild have been reported. No official patch or remediation guidance has been provided by the vendor as of now.

CVE-2026-7055 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the fromVirtualSer function in the /goform/VirtualSer component of the httpd service. The vulnerability arises from improper handling of the menufacturer/Go argument, allowing remote attackers to cause a buffer overflow. This issue has been publicly disclosed, but no known exploits are currently observed in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-7054 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It affects the fromPptpUserAdd function in the /goform/PPTPDClient component of the device's HTTP server. The vulnerability arises from improper handling of the opttype/username argument, allowing remote attackers to cause a buffer overflow. Exploit code has been publicly released, increasing the risk of attacks. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-7053 is a high-severity buffer overflow vulnerability in the Tenda F456 router firmware version 1.0.0.5. The flaw exists in the function frmL7ProtForm within the /goform/L7Prot component of the httpd service. It can be triggered remotely by manipulating the 'page' argument, potentially allowing an attacker to cause a buffer overflow. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Such manipulation of the argument menufacturer/Go leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in Tenda F456 1.0.0.5. Affected is the function SafeEmailFilter of the file /goform/SafeEmailFilter. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-7031 is a high-severity buffer overflow vulnerability in Tenda F456 version 1.0.0.5. It arises from improper handling of the 'page' argument in the fromSafeMacFilter function within the /goform/SafeMacFilter file. This flaw can be exploited remotely without user interaction or privileges. Although a public exploit exists, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-7029 is a high-severity buffer overflow vulnerability in the Tenda F456 router version 1.0.0.5. It exists in the fromaddressNat function of the /goform/addressNat file, where manipulation of the menufacturer/Go argument can trigger the overflow. The vulnerability is remotely exploitable without user interaction or privileges. Although an exploit is publicly available, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided yet.

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Multiple security vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 9. These vulnerabilities include crashes, denial-of-service, information disclosure, same-origin policy bypass, content security policy bypass, user fingerprinting, cross-site scripting, and sandbox escape issues triggered by processing maliciously crafted web content or websites. The Red Hat advisory rates the overall impact as Important and provides updates to address these issues.

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.