CVE-2026-47533 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an ar… |
CVE-2026-47525 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an ar… |
CVE-2026-47507 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds array access. A su… |
CVE-2026-102511 | | | 2026-09-30 | Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to se… |
CVE-2026-102510 | | | 2026-09-30 | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache… |
CVE-2026-102822 | Low | 3.7 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC blo… |
CVE-2026-100836 | Medium | 4.3 | 2026-09-27 | Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decod… |
CVE-2026-100654 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates o… |
CVE-2026-17413 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-61695 | High | 7.5 | 2026-09-23 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expe… |
CVE-2026-96675 | Low | 3.3 | 2026-09-23 | alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access… |
CVE-2026-62866 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCu… |
CVE-2026-65653 | | | 2026-09-21 | github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment read… |
CVE-2026-65652 | | | 2026-09-21 | github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener c… |
CVE-2026-16651 | | | 2026-09-21 | temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to fi… |
CVE-2026-93989 | Low | 3.1 | 2026-09-19 | vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). A… |
CVE-2026-93841 | Low | 3.7 | 2026-09-18 | vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset w… |
CVE-2026-93840 | Low | 3.7 | 2026-09-18 | vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). A… |
CVE-2026-63635 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63420 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-93592 | High | 7.5 | 2026-09-18 | vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to c… |
CVE-2026-91101 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-55209 | Critical | 9.8 | 2026-09-14 | resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields… |
CVE-2026-84445 | | | 2026-09-14 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.g… |
CVE-2026-49838 | Medium | 5.9 | 2026-09-10 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PAT… |
CVE-2026-88052 | High | 7.8 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count… |
CVE-2023-54396 | Medium | 6.5 | 2026-09-09 | PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inv… |
CVE-2026-87500 | Critical | 9.6 | 2026-09-09 | Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-0799 | High | 8.7 | 2026-09-05 | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libp… |
CVE-2026-57159 | High | 7.5 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the… |
CVE-2026-85084 | Medium | 6.3 | 2026-09-03 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |
CVE-2023-31308 | Low | 3.3 | 2026-08-31 | A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read. |
CVE-2026-82327 | Medium | 5.5 | 2026-08-28 | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache file… |
CVE-2026-19318 | | | 2026-08-28 | A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by se… |
CVE-2026-79775 | Medium | 6.5 | 2026-08-25 | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which… |
CVE-2026-13212 | High | 8.8 | 2026-08-24 | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virti… |
CVE-2026-17097 | High | 7.3 | 2026-08-19 | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the… |
CVE-2026-16849 | Medium | 4.3 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary. |
CVE-2026-65832 | High | 8.2 | 2026-08-17 | Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) va… |
CVE-2026-49282 | Medium | 5.1 | 2026-08-14 | Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to… |
CVE-2026-73489 | Medium | 4.3 | 2026-08-13 | Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request wi… |
CVE-2026-73564 | | | 2026-08-13 | frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to… |
CVE-2026-53792 | Medium | 6.5 | 2026-08-13 | rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory acce… |
CVE-2026-70635 | High | 7.1 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result int… |
CVE-2026-70634 | High | 8.1 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/alg… |
CVE-2026-52856 | High | 7.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SF… |
CVE-2026-64330 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
In svdm_consume_modes(), th… |
CVE-2026-64324 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
udf: validate free block extents against the partition length
udf_free_blocks() checks th… |
CVE-2026-64273 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
Input: iforce - bound the device-reported force-feedback effect index
iforce_process_pack… |
CVE-2026-64272 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - fix touch indexing for MMS134S and MMS136
The MMS134S and MMS136 touch co… |
CVE-2026-64271 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
Input: touchwin - reset the packet index on every complete packet
tw_interrupt() accumula… |
CVE-2026-64243 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: simple-mux: Fix enum control bounds check
simple_mux_control_put() rejects… |
CVE-2026-64225 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
cgx_speed_mbps has 13 element… |
CVE-2026-53387 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
iio: light: veml6075: add bounds check to veml6075_it_ms index
veml6075_it_ms has 5 eleme… |
CVE-2026-53386 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ti-ads1298: add bounds check to pga_settings index
ads1298_pga_settings has 7 e… |
CVE-2026-45799 | High | 7.5 | 2026-07-17 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoRea… |
CVE-2026-63308 | Medium | 4.3 | 2026-07-17 | Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows a… |
CVE-2026-46377 | Medium | 6.2 | 2026-07-16 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*T… |
CVE-2026-50144 | High | 7.1 | 2026-07-15 | ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier… |
CVE-2026-24238 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of this vulnerability mi… |
CVE-2026-15685 | High | 7.5 | 2026-07-13 | Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-servic… |
CVE-2026-57251 | High | 7.8 | 2026-07-08 | The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bo… |
CVE-2026-57272 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57271 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57270 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57269 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57268 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57267 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57266 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57265 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-57264 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13132 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-13131 | High | 8.3 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-14193 | High | 7.5 | 2026-07-01 | DVP80ES300T with Improper Validation of Array Index Vulnerability |
CVE-2026-14191 | High | 7.8 | 2026-07-01 | An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector… |
CVE-2026-22879 | High | 8.1 | 2026-06-25 | A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2). A specially craf… |
CVE-2026-56770 | High | 7.5 | 2026-06-25 | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential m… |
CVE-2026-52969 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
kvm_reset_dirty_gfn() guards the gfn… |
CVE-2026-56111 | Critical | 9.1 | 2026-06-24 | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421… |
CVE-2026-52915 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_hbh: reject oversized option lists
struct ip6t_opts stores at most IP6T_O… |
CVE-2026-32682 | Medium | 6.5 | 2026-06-17 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause t… |
CVE-2026-45624 | Medium | 5.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a poly… |
CVE-2026-45359 | Medium | 5.7 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-c… |
CVE-2026-24181 | High | 7.3 | 2026-06-09 | NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability migh… |
CVE-2026-25276 | High | 8.8 | 2026-06-01 | Memory corruption while using Strongbox due to missing bounds check. |
CVE-2026-46163 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: t… |
CVE-2026-46122 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled… |
CVE-2026-45104 | High | 7.5 | 2026-05-27 | MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLay… |
CVE-2026-45896 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
mtd: intel-dg: Fix accessing regions before setting nregions
The regions array is counted… |
CVE-2026-45839 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
CO-RE accessor strin… |
CVE-2026-46598 | Medium | 5.3 | 2026-05-22 | For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. |
CVE-2026-44310 | Medium | 5.4 | 2026-05-15 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git… |
CVE-2023-31309 | | | 2026-05-15 | Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data fr… |
CVE-2026-44222 | Medium | 6.5 | 2026-05-12 | vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s mul… |
CVE-2026-41643 | High | 7.5 | 2026-05-07 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) v… |
CVE-2026-40251 | Medium | 6.5 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authen… |
CVE-2026-31776 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix missing SPDIFI1 index handling
SPDIF1 DAIO type isn't properly handled i… |
CVE-2026-31764 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The st_lsm6dsx… |
CVE-2026-31729 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: validate connector number in ucsi_notify_common()
The connector number… |
CVE-2026-40886 | High | 7.7 | 2026-04-23 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index… |