SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing a...

CVE-2026-77375

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malf

历史摘要 · 未重新核验 · NVD

SFTPGo: Denial of service via malformed SSH channel request

CVE-2026-77375

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malf

历史摘要 · 未重新核验 · OSV.dev

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() w...

CVE-2026-109251

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface

历史摘要 · 未重新核验 · NVD

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#1...

CVE-2026-109250

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers

历史摘要 · 未重新核验 · NVD

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading...

CVE-2026-103220

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars

历史摘要 · 未重新核验 · NVD

Vyper: Memory corruption using function calls within tuples / nested calls

### Impact When performing a function call inside a tuple or as an argument inside another function call, there is a mem

历史摘要 · 未重新核验 · GitHub Advisory

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

CVE-2026-93321

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds

历史摘要 · 未重新核验 · NVD

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

CVE-2026-93322

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds

历史摘要 · 未重新核验 · NVD

Malformed MergeOp can crash the BuildKit daemon

CVE-2026-93322

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds

历史摘要 · 未重新核验 · OSV.dev

In Modem, there is a possible system crash due to a missing bounds check. This could lead to...

CVE-2026-20527

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, i

历史摘要 · 未重新核验 · GitHub Advisory

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled b...

CVE-2026-20527

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, i

历史摘要 · 未重新核验 · NVD

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because ...

CVE-2026-102822

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate

历史摘要 · 未重新核验 · NVD

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

CVE-2026-102822

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate

历史摘要 · 未重新核验 · OSV.dev

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's...

CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO

历史摘要 · 未重新核验 · GitHub Advisory

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext leng...

CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO

历史摘要 · 未重新核验 · NVD

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the value...

CVE-2026-100654

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/cha

历史摘要 · 未重新核验 · NVD

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

CVE-2026-100654

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/cha

历史摘要 · 未重新核验 · OSV.dev

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknown...

CVE-2026-61695

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S

历史摘要 · 未重新核验 · NVD

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

CVE-2026-61695

### Summary Wire's Swift runtime (`Wire` SPM/CocoaPods product, implemented by `wire-runtime-swift`) did not reject a n

历史摘要 · 未重新核验 · GitHub Advisory

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

CVE-2026-61695

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S

历史摘要 · 未重新核验 · OSV.dev