CWE-126

581 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 8High 271Medium 279Low 23Not scored 0

CVEs per yearBy the year they were published

CVE-2026-124317
libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16
libexpat · libexpat
Medium6.3
CVE-2026-93524
X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
x.org · xorg-x11-server
Medium6.9
CVE-2026-57185
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
asterisk · asterisk
Medium6.5
CVE-2026-55606
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
openwrt · odhcpd
Medium6.5
CVE-2026-53920
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
openwrt · odhcpd
High8.7
CVE-2026-107928
info leak uploading over WebSockets with GnuTLS
curl · curl
High8.1
CVE-2026-112404
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
python-pillow · Pillow
High8.8
CVE-2026-112394
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
python-pillow · Pillow
Medium6.3
CVE-2026-85745
MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
MariaDB · server
Medium4.3
CVE-2026-46471
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past…
Product not named
Medium5.5