CWE-129 · Improper Validation of Array Index (page 2)
Page 2 of 7 — CVEs classified under CWE-129, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6840 | Medium | 5.5 | 2026-04-22 | Missing bounds validation for operator could allow out of range operator-code lookup during model loading Affected version is prior to commit 1.30.0. |
CVE-2026-40097 | Low | 3.7 | 2026-04-10 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger a… |
CVE-2026-34942 | Medium | 6.5 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's… |
CVE-2026-21413 | Critical | 9.8 | 2026-04-07 | A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted… |
CVE-2026-23448 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16()… |
CVE-2026-23447 | High | 7.8 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug… |
CVE-2026-33762 | Low | 2.8 | 2026-03-31 | go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate t… |
CVE-2026-32286 | High | 7.5 | 2026-03-26 | The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative f… |
CVE-2026-32285 | High | 7.5 | 2026-03-26 | The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allow… |
CVE-2026-23354 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if t… |
CVE-2026-33281 | Medium | 6.5 | 2026-03-24 | Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with invalid PDU Session IDs outside of 1-15… |
CVE-2026-33022 | Medium | 6.5 | 2026-03-20 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1… |
CVE-2026-32937 | Medium | 6.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedchargin… |
CVE-2026-26933 | Medium | 5.7 | 2026-03-19 | Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC… |
CVE-2026-31967 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31966 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-31965 | High | 8.2 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31963 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-31962 | High | 8.8 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most align… |
CVE-2026-23246 | High | 8.8 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken fro… |
CVE-2026-3083 | High | 8.8 | 2026-03-16 | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2026-30984 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccCalcul… |
CVE-2026-30982 | Medium | 6.1 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXfo… |
CVE-2026-26932 | Medium | 5.7 | 2026-02-26 | Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153)… |
CVE-2026-25882 | High | 7.5 | 2026-02-24 | Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the… |
CVE-2025-69248 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overf… |
CVE-2025-71203 | High | 7.0 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: riscv: Sanitize syscall table indexing under speculation The syscall number is a user-con… |
CVE-2023-20601 | | 2026-02-12 | Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-of-service conditio… | |
CVE-2026-2006 | High | 8.8 | 2026-02-12 | Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun… |
CVE-2026-25585 | High | 7.8 | 2026-02-04 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-25518 | Medium | 5.9 | 2026-02-04 | cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using th… |
CVE-2026-25068 | | 2026-01-29 | alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The… | |
CVE-2026-22859 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_I… |
CVE-2025-71143 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: clk: samsung: exynos-clkout: Assign .num before accessing .hws Commit f316cdff8d67 ("clk… |
CVE-2026-0529 | Medium | 6.5 | 2026-01-14 | Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specia… |
CVE-2026-0528 | Medium | 6.5 | 2026-01-13 | Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153… |
CVE-2025-71100 | High | 7.6 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ie… |
CVE-2025-71086 | High | 7.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collect… |
CVE-2025-47393 | High | 7.8 | 2026-01-07 | Memory corruption when accessing resources in kernel driver. |
CVE-2025-15271 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-15270 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-65562 | High | 7.5 | 2025-12-18 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send… |
CVE-2025-66559 | | 2025-12-04 | Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and… | |
CVE-2025-61915 | Medium | 6.0 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can u… |
CVE-2025-0657 | | 2025-11-27 | A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/T… | |
CVE-2025-65499 | Medium | 4.3 | 2025-11-24 | Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS… |
CVE-2025-62372 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimod… |
CVE-2025-10158 | Medium | 4.3 | 2025-11-18 | A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The … |
CVE-2025-47361 | High | 7.8 | 2025-11-04 | Memory corruption when triggering a subsystem crash with an out-of-range identifier. |
CVE-2025-47352 | High | 7.8 | 2025-11-04 | Memory corruption while processing audio streaming operations. |
CVE-2023-53485 | High | 7.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the fo… |
CVE-2025-27034 | Critical | 9.8 | 2025-09-24 | Memory corruption while selecting the PLMN from SOR failed list. |
CVE-2025-23338 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasm on a malicious ELF… |
CVE-2023-53395 | High | 7.8 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741… |
CVE-2023-53340 | High | 7.8 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general… |
CVE-2025-39823 | High | 7.8 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are gu… |
CVE-2022-50315 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS UBSAN complains about array-index-o… |
CVE-2023-53192 | Critical | 9.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is retu… |
CVE-2024-21970 | Medium | 4.4 | 2025-09-06 | Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a l… |
CVE-2023-31306 | Low | 3.3 | 2025-09-06 | Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management (… |
CVE-2025-38697 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllo… |
CVE-2025-57052 | Critical | 9.8 | 2025-09-03 | cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass a… |
CVE-2025-27075 | High | 7.8 | 2025-08-06 | Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host. |
CVE-2025-27067 | High | 7.8 | 2025-08-06 | Memory corruption while processing DDI call with invalid buffer. |
CVE-2025-54650 | Medium | 4.2 | 2025-08-06 | Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect the audio decoding… |
CVE-2025-54645 | Medium | 5.0 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability ma… |
CVE-2025-54644 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54643 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54610 | Medium | 5.4 | 2025-08-06 | Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-23278 | High | 7.1 | 2025-08-02 | NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted… |
CVE-2025-38367 | High | 8.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Avoid overflow with array index The variable index is modified and reused… |
CVE-2025-38239 | High | 7.3 | 2025-07-09 | In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix invalid node index On a system with DRAM interleave enabled, out-… |
CVE-2024-53009 | Medium | 5.3 | 2025-07-08 | Memory corruption while operating the mailbox in Automotive. |
CVE-2025-38198 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to wri… |
CVE-2025-38146 | Critical | 9.4 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end… |
CVE-2024-35164 | Medium | 6.8 | 2025-07-02 | The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If… |
CVE-2022-50066 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aq_vec index out of range error The final update statement of the for… |
CVE-2025-38013 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure th… |
CVE-2025-5868 | High | 8.0 | 2025-06-09 | A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thr… |
CVE-2025-5866 | High | 8.0 | 2025-06-09 | A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function sys_sigprocmask of the file rt-thread/components/lwp/lwp_sy… |
CVE-2025-3357 | Critical | 9.8 | 2025-05-28 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code due to improper validation of an index va… |
CVE-2025-48075 | High | 7.5 | 2025-05-22 | Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to n… |
CVE-2025-1975 | High | 7.5 | 2025-05-16 | A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and s… |
CVE-2024-45578 | High | 7.8 | 2025-05-06 | Memory corruption while acquire and update IOCTLs during IFE output resource ID validation. |
CVE-2024-45576 | High | 7.8 | 2025-05-06 | Memory corruption while prociesing command buffer buffer in OPE module. |
CVE-2024-45574 | High | 7.8 | 2025-05-06 | Memory corruption during array access in Camera kernel due to invalid index from invalid command data. |
CVE-2025-37752 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate t… |
CVE-2025-40114 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains on… |
CVE-2025-40014 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() If speed_hz < AMD… |
CVE-2025-39728 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hittin… |
CVE-2025-22067 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() If requested… |
CVE-2025-21447 | High | 7.8 | 2025-04-07 | Memory corruption may occur while processing device IO control call for session control. |
CVE-2025-21423 | High | 7.8 | 2025-04-07 | Memory corruption occurs when handling client calls to EnableTestMode through an Escape call. |
CVE-2025-21991 | High | 7.8 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_… |
CVE-2023-53019 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as… |
CVE-2023-53000 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and vali… |
CVE-2023-52988 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_co… |
CVE-2023-52987 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() The "id"… |
CVE-2025-30077 | Medium | 6.2 | 2025-03-16 | Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits. |
CVE-2024-53014 | High | 7.8 | 2025-03-03 | Memory corruption may occur while validating ports and channels in Audio driver. |