CVEs classified under CWE-124, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (23)
CVE-2026-44631 — CVSS 9.8 (critical): Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP…
CVE-2023-25610 — CVSS 9.8 (critical): A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3…
CVE-2025-27440 — CVSS 8.5 (high): Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVE-2025-27439 — CVSS 8.5 (high): Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVE-2026-34253 — CVSS 8.2 (high): A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in…
CVE-2026-0966 — CVSS 8.2 (high): A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This…
CVE-2025-62786 — CVSS 8.1 (high): Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based out-of-bounds WRITE occurs in…
CVE-2025-61690 — CVSS 7.8 (high): KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code…
CVE-2024-52990 — CVSS 7.8 (high): Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in…
CVE-2022-33896 — CVSS 7.8 (high): A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A…
CVE-2021-36064 — CVSS 7.8 (high): XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in…
CVE-2025-53101 — CVSS 7.4 (high): ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26…
CVE-2026-5089 — CVSS 7.3 (high): YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck.h has a buffer…
CVE-2026-41499 — CVSS 6.5 (medium): Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4…
CVE-2025-20694 — CVSS 6.5 (medium): In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no…
CVE-2026-20104 — CVSS 6.1 (medium): A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series…
CVE-2025-61915 — CVSS 6.0 (medium): OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the…
CVE-2026-28419 — CVSS 5.3 (medium): Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags…
CVE-2025-4373 — CVSS 4.8 (medium): A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which…
CVE-2024-36343: Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of…
CVE-2024-36310: Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to…
CVE-2026-26204 — CVSS 4.4 (medium): Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4…
CVE-2026-1485 — CVSS 2.8 (low): A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is…