CVE-2026-116781 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the ws_read_frame() function when unmasking WebSocket payloads, potentially causing writes up to 14 bytes beyond the receive buffer and a terminating NUL byte one byte out of bounds. This vulnerability is reachable before authentication if mod_xml_rpc and its WebSocket endpoint are enabled, though these features are disabled by default. The out-of-bounds writes remain within the same connection handle's adjacent outbound buffer, and no process crash or cross-session data disclosure has been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116574 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The function switch_xml_ampencode() reserved insufficient space for a terminating NUL byte when encoding four-byte UTF-8 sequences, causing a one-byte heap overflow when serializing remote-supplied text at a buffer boundary. This flaw affects multiple XML serialization outputs that handle caller-controlled values. The issue can cause process aborts or memory corruption but has not been shown to enable remote code execution. The vulnerability is fixed in FreeSWITCH version 1.11.2.
CVE-2026-120061 is a stack-based buffer overflow vulnerability in the psqlODBC driver for PostgreSQL. The issue arises from improper handling of ODBC escape sequences in SQL text, where argument offsets for {fn} escapes are written into a fixed-size stack array without bounds checking. This can lead to stack overflow and memory corruption. Additionally, certain escape sequences ({d}, {t}, {ts}, {escape}) write one byte beyond a 128-byte stack buffer. Applications forwarding untrusted SQL text to the driver are at risk. Versions before 18.00.0006 are affected.
vLLM versions prior to 0.32.0 contain an improper validation of array index vulnerability in the tokenization process. Specifically, an off-by-one error allows a pre-tokenized prompt ID equal to the vocabulary size to bypass validation, leading to a CUDA device-side assertion failure and engine termination. This issue is fixed in version 0.32.0.
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
CVE-2026-108443 is an off-by-one error vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.8 and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. Official patches have been released to address this issue.
CVE-2026-97741 is a heap-based buffer overflow vulnerability in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to 16.114.26101123. Microsoft has released an official fix in version 16.114.26101123. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild at this time.
CVE-2026-102857 is a heap-based buffer overflow vulnerability in Microsoft Office Visio within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects specific versions prior to the fixed releases 16.0.14334.20974 and 16.0.17932.21056. Microsoft has issued an official fix for this vulnerability. The CVSS v3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
A vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x allows attackers to bypass WAF rules due to an encoding error in the t:jsDecode transformation. This flaw causes JavaScript octal escape sequences to be improperly decoded, resulting in null byte output that corrupts rule inspection. The issue is fixed in version 3.8.0.
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
An off-by-one error (CWE-193) in OpenSSH's ssh-keygen before version 10.6 causes certificates to have incorrect expiration times due to mishandling of Daylight Saving Time. This issue can have a slightly more severe effect on users in certain Antarctic locations. The vulnerability has a low CVSS score of 2.5 and does not impact confidentiality or availability, only integrity to a limited extent.
CVE-2026-102720 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. The DHCP client improperly advances its option walk offset, causing it to read up to about one kilobyte beyond the received DHCP message. This can lead to copying out-of-bounds bytes into the application's buffer when retrieving user options.
CVE-2026-18460 is an off-by-one error vulnerability in RTI Connext Professional Core Libraries that allows out-of-bounds write leading to buffer overflow. It affects versions from 7.0.0 up to but not including 7.3.1.6, and from 7.4.0 up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No known exploits are reported in the wild. No vendor patch or official fix information is provided in the available data.
Imager versions before 1.036 for Perl contain a vulnerability where reading a paletted image with pixel indexes beyond the color map causes uninitialized heap memory disclosure. The palette is allocated without initialization, and pixel indexes equal to the palette size read unpopulated entries, leaking prior heap contents. This occurs when reading attacker-supplied images and then fetching pixels or converting them to RGB.
CVE-2026-81396 is a stack-based buffer overflow vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code locally on affected systems. The vulnerability has a high severity score of 7.8 and affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.
CVE-2026-69609 is a medium-severity vulnerability in Microsoft Office 365 for Mac involving an out-of-bounds read in Windows Win32K. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects multiple versions of Office 365 for Mac prior to fixed releases. Microsoft has issued official fixes for the vulnerability.
CVE-2026-57160 is an off-by-one buffer overflow vulnerability in the pjsip_generic_array_hdr_print() function of the pjsip pjproject library. This function serializes generic array headers in SIP messages. The flaw allows writing one byte past the end of the output buffer under certain boundary conditions, mainly affecting applications that parse and re-serialize SIP requests. The vulnerability has been patched.
CVE-2026-46369 is an off-by-one error in the Nimiq core-rs-albatross Rust implementation of the Albatross consensus algorithm. Versions prior to 1.5.1 have a flaw in the validity store's transaction expiration logic, allowing a remote attacker to replay the same signed transaction within a specific block window. This replay can cause sender and recipient balances to be updated twice. The issue is fixed in version 1.5.1.
An off-by-one error vulnerability (CWE-193) in Apache Tomcat's rewrite valve processing causes the rewrite to restart at the second rule instead of the first. This affects multiple versions of Apache Tomcat from 8.5.0 through 11.0.24. The issue has been fixed in versions 11.0.25, 10.1.58, and 9.0.121. The vulnerability has a CVSS score of 7.5, indicating high severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-63387 is a stack-based buffer overflow vulnerability in libevent prior to versions 2.1.13 and 2.2.2-alpha. The flaw occurs in the evdns.c component when formatting DNS records, allowing a one-byte out-of-bounds write on the stack. This can be triggered by a crafted DNS server response containing certain DNS record types, potentially causing process crashes or memory corruption. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.