CVE-2026-53021
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_exe
CVSS
5.5
Medium
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Jun 24, 2026 · Last modified: Jul 15, 2026 · CWE-190
0.1%EPSS · 30 days0.2%
2026-06-302026-07-16
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_execute_unmap() checks LBA + range does not exceed the device capacity, but does not guard against LBA + range wrapping around on 64-bit overflow. Add an overflow check matching the pattern already used for WRITE_SAME in the same file.
- git.kernel.orghttps://git.kernel.org/stable/c/02115986d027ade793e7f6be87e91d6a796d0aa3
- git.kernel.orghttps://git.kernel.org/stable/c/2bf2d65f76697820dbc4227d13866293576dd90a
- git.kernel.orghttps://git.kernel.org/stable/c/2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd
- git.kernel.orghttps://git.kernel.org/stable/c/3facdecc3fcf115cc4f9b3d8f118d6705e2456a8
- git.kernel.orghttps://git.kernel.org/stable/c/51075df70c46e60a9773f2dcd28299e40dac36fb
- git.kernel.orghttps://git.kernel.org/stable/c/5efc3ef4758f8d98c257419fa21daca3227de61a
- git.kernel.orghttps://git.kernel.org/stable/c/c08ab702c4699c6efb9d60bdb15b73e7a627ee7e
- git.kernel.orghttps://git.kernel.org/stable/c/d7aef29573c7c5cdb2dfad939253287a6329c2a4
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-292387.5 HIG96.6%
——29An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.8dCVE-2022-250627.5 HIG87.6%
——26TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.8dCVE-2023-458539.8 CRI86.6%
——26MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.3dCVE-2026-489337.5 HIG84.9%
——25A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.21hCVE-2024-220519.8 CRI70.4%
——21CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.2dCVE-2026-78388.8 HIG69.5%
——21UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).8d