CVE-2026-18321
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
CVSS
4.7
Medium
EPSS
0.1%
p0
KEV
—
Exploit Today
0
0-100
Published: Jul 31, 2026 · Last modified: Aug 28, 2026 · CWE-120
0.1%EPSS · 30 days0.1%
2026-08-202026-09-17
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-767055.5 MED44.3%
——13A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system.1dCVE-2026-766956.5 MED30.9%
——9Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to send specially crafted packets to the affected service. Successful exploitation could allow an attacker to affect the integrity and availability of the affected service.1dCVE-2026-587108.8 HIG19.4%
——6In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.1dCVE-2026-586957.8 HIG0.1%
——0In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.21hCVE-2026-569788.4 HIG0.1%
——0In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.21hCVE-2026-568926.2 MED0.1%
——0In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.1d