### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with **byte** indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“by

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into th

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

CVE-2026-45352 影响 cpp-httplib（一个 C++11 单文件头跨平台 HTTP/HTTPS 库）0.43.4 之前的版本。漏洞存在于分块传输编码的解析过程中：函数 ChunkedDecoder::read_payload 使用 std::strtoul() 解析分块大小字段，而 strtoul 根据 C 标准会接受前导负号并执行无符号回绕。例如，strtoul("-2", …, 16) 返回 ULONG_MAX - 1 (0xFFFFFFFFFFFFFFFE)。该库仅在行 12833 处检查 ULONG_MAX（即 "-1" 的结果），但像 "-2" 这样的其他负值能够通过验证。导致 chunk_remaining 被赋值为一个接近最大值的无符号整数，进而控制服务器读取循环从网络消费的字节数。攻击者无需认证即可通过网络发送特制的分块编码请求，触发服务器无界的内存分配，最终导致进程崩溃（拒绝服务）。CVSS 评分 5.3，属于中等严重性。修复版本 0.43.4 已发布，建议所有受影响用户立即升级。临时缓解措施包括限制对受影响服务的网络访问或部署 Web 应用防火墙（WAF）过滤恶意分块编码请求。

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).