{"items":[{"id":"CVE-2026-41503","published":"2026-04-24T19:41:44.071Z","updated":"2026-04-27T13:39:56.518Z","title":"BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser","severity":"HIGH","score":8.7,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-41502","published":"2026-04-24T19:40:43.059Z","updated":"2026-04-25T01:53:32.781Z","title":"BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder","severity":"HIGH","score":8.7,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-41475","published":"2026-04-24T19:39:52.367Z","updated":"2026-04-27T13:41:36.425Z","title":"BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser","severity":"HIGH","score":8.7,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-40279","published":"2026-04-21T16:29:16.125Z","updated":"2026-04-21T19:18:58.492Z","title":"BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`","severity":"LOW","score":3.7,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-26264","published":"2026-02-13T18:14:30.232Z","updated":"2026-02-13T18:50:30.367Z","title":"BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash","severity":"HIGH","score":7.8,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-21878","published":"2026-02-13T18:10:26.325Z","updated":"2026-02-13T18:53:59.648Z","title":"BACnet Stack Improperly Limits Pathnames to a Restricted Directory","severity":"HIGH","score":7.5,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-21870","published":"2026-02-13T17:58:37.205Z","updated":"2026-02-13T18:19:36.183Z","title":"The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string","severity":"MEDIUM","score":5.5,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2025-66624","published":"2025-12-05T18:36:26.280Z","updated":"2025-12-08T17:28:39.912Z","title":"BACnet-stack MS/TP reply matcher OOB read","severity":"HIGH","score":7.5,"vendor":"bacnet-stack","product":"bacnet-stack","kev":false,"epss":0.00443,"kevAdded":null}]}