CVE-2026-114460
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query,
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 22, 2026 · Last modified: Oct 22, 2026 · CWE-193
Not enough EPSS history yet.
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-127274.3 MED11.3%
——3IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.3dCVE-2026-1112736.1 MED3.3%
——1unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.6dCVE-2026-1084438.8 HIG36.4%
——11Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.3dCVE-2026-1013026.5 MED35.2%
——11TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.
A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).3dCVE-2026-1106043.6 LOW11.9%
——4Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.8dCVE-2026-977418.8 HIG55.4%
——17Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.7d