GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanged for an empty, duplicate, or already-encodable representation, causing id to become larger than un

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanged for an empty, duplicate, or already-encodable representation, causing id to become larger than un

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS). Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 s

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, o

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :arc

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed ca

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore n

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.

### Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice. ### Patches The bug has been patched starting with version 6.2.9.

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-cont

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys fil

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta comp

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta comp

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

### Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. ### Impact All wings users with an open SFTP port. ### Workarounds Close SFTP port.

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps` process with a single five-byte message. When the gateway parses an SSH `exec` channel request in `pkg/ssh/server.go`, it adds a small constant to a four-byte length value taken directly from the request. Because that length is fully attacke

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and m

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Eng

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Eng

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Eng

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go ind

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go ind

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id

NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of this vulnerability might lead to code execution.

NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of this vulnerability might lead to code execution.

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied

Found through variant analysis based on `CVE-2026-41643` ## Summary GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured co

The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application.

GeoVision 软件（如 GV-VMS、GV-Cloud）的 GeoWebPlayer 插件（也称为 Web Plugin 或 WS Player）中，其 WebSocket 服务器在处理来自 localhost 的命令时，对部分命令中的 `index` 参数缺乏有效的范围检查。攻击者可通过向本地 WebSocket 端口发送特制命令，利用该索引越界漏洞读写多个数组的越界元素，从而可能执行任意代码、提升权限或造成拒绝服务。CVSS 3.1 评分为 8.3（高危），攻击向量为网络，复杂度高，无需身份验证，但需要用户交互（如诱导用户访问恶意网页）。目前该漏洞尚未被列入已知被利用漏洞目录（KEV），也未有在野利用报告。受影响的 GeoVision 软件版本尚未明确，但凡安装了该插件的系统均可能存在风险。建议用户立即关注厂商安全公告，尽快安装官方补丁；同时限制 GeoWebPlayer 的 WebSocket 接口仅对受信任的本地进程开放，或在不必要的情况下禁用该插件。

CVE-2026-57271 是 GeoVision 系列软件中 GeoWebPlayer 插件的一个高危漏洞。GeoWebPlayer（在 GV-VMS 文档中称为“Web Plugin”，在 VMS-Cloud 中称为“WS Player”）是一个随 GV-VMS、GV-Cloud 等产品安装的附加组件，用于创建 WebSocket 服务器以增强 Web 界面功能。该漏洞位于暂停命令处理中，属于索引越界（index-out-of-bound）缺陷，攻击者可利用特制请求触发内存错误，可能导致远程代码执行或服务崩溃。CVSS 评分为 8.3（高危），攻击向量为网络远程，但需要用户交互（UI:R）和高复杂度（AC:H），影响机密性、完整性和可用性（均为高）。目前没有证据表明该漏洞已被在野利用或列入已知被利用漏洞目录。受影响的具体产品版本和厂商信息尚未公布，但任何安装 GeoWebPlayer 的 GeoVision 软件都可能受影响。建议用户密切关注 GeoVision 官方安全公告，及时应用补丁；在补丁发布前，限制对 GeoWebPlayer 服务的网络访问，特别是避免暴露在公网。

GeoWebPlayer（在GV-VMS文档中称为“Web Plugin”，在VMS-Cloud中称为“WS Player”）是随多个GeoVision软件（如GV-VMS、GV-Cloud等）一起安装的附加组件。该组件会创建一个WebSocket服务器，用于扩展GeoVision软件提供的各种Web界面的功能，并且某些功能可能依赖于此服务器才能正常运行。 该WebSocket服务器可接受来自localhost的各种命令。许多命令会接受一个`index`值，然后使用该值访问多个数组以进入关键代码段、执行函数调用等。然而，`index`值通常未经有效范围检查，因此可被利用来对多个数组进行越界（Out-of-Bounds）访问。 具体而言，以`play`命令为例，其处理逻辑中的数组索引缺乏边界验证，攻击者可以通过精心构造的请求触发数组越界读写。这可能导致读取或写入分配数组之外的内存区域，从而造成信息泄露、程序崩溃或执行任意代码。 该漏洞的CVSS评分为8.3（高危），攻击向量为网络（AV:N），攻击复杂度较高（AC:H），需要用户交互（UI:R），但影响范围包括机密性、完整性和可用性（均为高）。未公开的在野利用证据，但漏洞本身的严重性较高。受影响产品包括GeoVision的多种软件套件，建议用户及时关注厂商提供的安全更新。

CVE-2026-57269 是 GeoWebPlayer（也称为 GV-VMS 中的 Web Plugin 或 VMS-Cloud 中的 WS Player）插件中的一个越界访问漏洞。该插件可随 GeoVision 的多种软件（如 GV-VMS、GV-Cloud、GV-VSM 等）安装，并创建一个 WebSocket 服务器，用于扩展 Web 界面功能。由于服务器接受来自 localhost 的命令，且许多命令使用未经验证的索引值（index）访问数组，攻击者可通过精心构造的请求触发越界读写，尤其是 disconnect 命令存在 index 越界问题。成功利用此漏洞可能导致内存破坏、代码执行或服务崩溃。CVSS 评分为 8.3（高），攻击向量为网络，但攻击复杂度高且需要用户交互。目前该漏洞尚未被列入已知被利用漏洞目录（KEV）或报告在野利用。受影响产品包括安装了 GeoWebPlayer 插件的 GeoVision 系列软件。建议用户及时关注厂商补丁或升级版本，同时限制 WebSocket 端口的网络暴露（仅允许 localhost 访问）以降低风险。由于缺乏详细信息，本摘要基于元数据生成。

GeoWebPlayer（也称为GV-VMS文档中的“Web Plugin”和VMS-Cloud的“WS Player”）是GeoVision系列软件（如GV-VMS、GV-Cloud等）的一个附加组件，用于创建WebSocket服务器以扩展Web界面功能。该WebSocket服务器接收来自localhost的命令，其中`saveVideo`命令在处理`index`字段时未进行范围检查，导致越界访问多个数组。具体而言，`index`值被用于进入关键区段（CriticalSection）并执行函数指针调用，攻击者可通过精心构造的WebSocket消息触发越界读写，最终可能实现任意代码执行。该漏洞影响所有安装了GeoWebPlayer插件的GeoVision软件版本。CVSS评分为8.3，属于高危漏洞，但尚未被列入已知利用列表（KEV），也未见在野利用报告。建议用户立即更新GeoWebPlayer至最新版本，并限制仅允许本地访问WebSocket服务（默认配置下该服务仅监听localhost）。

GeoWebPlayer（GV-VMS 文档中称为“Web Plugin”，VMS-Cloud 中称为“WS Player”）是 GeoVision 系列软件（GV-VMS、GV-Cloud 等）的一个附加组件。该组件创建一个 WebSocket 服务器，扩展了 GeoVision 软件 Web 界面的功能，且可能是其正常运行的必要组件。该 WebSocket 服务器接受来自 localhost 的各种命令。许多命令使用一个 `index` 参数来访问数组中的关键部分、执行函数调用等。然而，`index` 值通常未进行有效范围检查，导致可对多个数组进行越界访问。攻击者通过精心构造的请求，可利用此漏洞实现越界读写，进而可能执行任意代码或造成拒绝服务。该漏洞影响广泛使用的视频监控系统，一旦被利用，攻击者可完全控制受影响设备，导致敏感视频数据泄露、系统破坏等严重后果。目前暂无在野利用报告，但鉴于漏洞严重性，强烈建议用户尽快更新至官方修复版本。在无法立即更新的情况下，应限制 GeoWebPlayer 的网络暴露范围，仅允许受信任的主机访问。

GeoVision 系列软件（GV-VMS、GV-Cloud 等）中的 GeoWebPlayer 插件（亦称“Web Plugin”或“WS Player”）存在一个高危的数组越界漏洞。该插件会创建一个 WebSocket 服务器，用于增强软件 Web 界面的功能。该服务器接受来自 localhost 的各类命令，其中许多命令使用 `index` 参数访问数组以进入关键代码段。然而，`index` 值未经过有效的范围检查，导致攻击者可通过构造超出边界的 `index` 值越界访问多个数组，进而触发未定义行为或执行任意操作。漏洞存在于“2wayAudio”命令中，CVSS 评分为 8.3（CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H），属于高严重性。攻击利用条件较复杂：需要网络邻接性、攻击者需具备一定交互（UI:R），但无需特权。成功利用可能导致机密性、完整性和可用性完全丧失（C:H/I:H/A:H），且影响范围可能扩展至其他组件（S:C）。目前尚未有公开的野外利用报告，未列入 CISA KEV 目录。受影响的具体产品版本未详细披露。建议用户立即关注 GeoVision 官方安全公告，及时升级到包含补丁的版本。在未修复前，限制 GeoWebPlayer 的网络暴露，仅允许受信任的 localhost 访问，并监控异常 WebSocket 连接。

GeoWebPlayer（在GV-VMS文档中也称为“Web Plugin”，在VMS-Cloud中称为“WS Player”）是GeoVision系列软件（如GV-VMS、GV-Cloud等）的一个附加组件。该组件创建一个WebSocket服务器，用于扩展各类Web界面的功能，在某些情况下是软件正常运行所必需的。该WebSocket服务器接受来自localhost的多种命令，其中许多命令会使用一个`index`参数来访问数组，进而进入关键代码段或执行函数调用。然而，`index`参数通常未经过有效的范围检查，导致攻击者可以利用该参数实现多个数组的越界访问。例如，在audio命令中，越界访问可导致内存破坏。虽然攻击复杂度较高（需要用户交互），但远程攻击者无需认证即可利用此漏洞，且可能影响保密性、完整性和可用性，CVSS评分为8.3（高危）。目前该漏洞尚未被列入已知被利用漏洞目录（KEV），也未发现公开的在野利用报告。受影响的软件包括GeoVision GV-VMS、GV-Cloud等集成了GeoWebPlayer的版本。建议用户尽快联系厂商获取补丁，或采取临时缓解措施，如限制WebSocket服务的网络暴露、仅允许来自信任源的连接，并禁用不必要的功能模块。

GeoWebPlayer（在GV-VMS文档中称为“Web Plugin”，在VMS-Cloud中称为“WS Player”）是GeoVision软件（如GV-VMS、GV-Cloud等）的一个附加组件，用于创建WebSocket服务器以扩展Web界面功能。该WebSocket服务器接受来自localhost的命令，其中许多命令使用`index`参数访问数组，但由于未对`index`值进行有效范围检查，导致多个数组可被越界访问。例如`setPIP`命令存在基于索引的越界读写漏洞。攻击者可利用该漏洞实现远程代码执行、提权或数据泄露。CVSS评分为8.3（高），攻击复杂度较高，需用户交互，但无需认证即可通过网络触发。目前未发现活跃利用。建议用户限制GeoWebPlayer的网络暴露，仅允许可信源访问，并尽快安装厂商补丁。

CVE-2026-13132 影响 GeoVision 旗下多款软件（如 GV-VMS、GV-Cloud 等）的可选插件 GeoWebPlayer（也称作 Web Plugin 或 WS Player）。该插件会创建一个 WebSocket 服务器，用于增强软件 Web 界面的功能。该 WebSocket 服务器接受来自 localhost 的各种命令。其中 setStream 命令在处理时使用了一个 `index` 参数来访问数组，但未对 `index` 进行有效的范围检查，导致攻击者可以通过越界访问数组，触发内存错误或执行恶意操作。该漏洞的 CVSS 评分为 8.3（高危），攻击复杂度较高（需攻击者位于本地网络且需用户交互），但无需身份认证即可利用。成功利用可能导致机密性、完整性和可用性完全丧失。目前尚未有证据表明该漏洞已在野外被利用，也未列入 CISA KEV。受影响的具体产品版本尚未公布。建议用户密切关注 GeoVision 的安全公告，及时应用补丁；在补丁可用前，应限制 WebSocket 服务器的网络暴露，避免非授权访问，并监控 localhost 的异常连接请求。

CVE-2026-13131 影响 GeoVision 软件系列（如 GV-VMS、GV-Cloud 等）中安装的 GeoWebPlayer 插件（也称为 Web Plugin 或 WS Player）。该插件创建一个 WebSocket 服务器，用于扩展软件 Web 界面的功能。WebSocket 服务器接受来自 localhost 的多种命令，其中许多命令使用 `index` 参数访问数组以执行关键操作或函数调用。然而，`index` 值未经过有效的范围检查，导致攻击者可以通过精心构造的请求触发多个数组的越界访问（Out-of-Bounds）。此漏洞可能被利用来读取或写入越界内存，进而导致信息泄露、权限提升或任意代码执行。CVSS 评分为 8.3（高），攻击向量为网络，攻击复杂度高，无需身份认证但需要用户交互。目前该漏洞未被列入已知被利用漏洞目录（KEV），也未发现公开的在野利用报告。受影响产品包括 GeoVision GV-VMS、GV-Cloud 等软件，具体版本信息不详，建议用户关注厂商安全公告并及时更新至修复版本。缓解措施包括限制 WebSocket 服务仅监听可靠网络接口或通过防火墙规则限制 localhost 访问。

DVP80ES300T with Improper Validation of Array Index Vulnerability

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421 G-code handler that allows attackers to corrupt firmware memory by supplying out-of-range X and Y grid indices. Attackers can send a single crafted G-code command via USB serial, network interface, or malicious gcode file to write an attacke

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.

NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Memory corruption while using Strongbox due to missing bounds check.

Memory corruption while using Strongbox due to missing bounds check.

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer de

### Summary `dasel`'s selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends with a trailing backslash (e.g., `"\` or `'\`). A 2-byte input causes an immediate process crash via Go runtime panic. I confirmed the issue on `v3.3.1` (`fba653c7f248aff10f2b89fca93929b64707dfc8`) and on `master` commit `0dd6132e0c58edbd9b1a5f7ffd00dfab1e6085ad`. I also verifie

# CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented `IOException` / `ProtocolException` failure path. This can crash services that decode untrusted protobuf p

When performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments.

An invalid `connected-components:keep-top` value could result in a heap buffer over-read when performing the connected components operation.

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM potentially resulting in a loss of confidentiality and/or availability.

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM potentially resulting in a loss of confidentiality and/or availability.

vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position comp

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shif

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, a

## Summary This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading a