CVE-2026-84966 | Medium | 5.1 | 2026-09-03 | An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly… |
CVE-2026-84963 | Medium | 5.3 | 2026-09-03 | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently sho… |
CVE-2026-84970 | Medium | 6.2 | 2026-09-03 | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
CVE-2026-82522 | Medium | 5.4 | 2026-09-02 | libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploit… |
CVE-2026-82457 | High | 7.8 | 2026-08-29 | su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-… |
CVE-2026-75145 | Medium | 5.8 | 2026-08-19 | FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to l… |
CVE-2026-19879 | Medium | 5.3 | 2026-08-14 | A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16… |
CVE-2026-6426 | Medium | 4.4 | 2026-08-10 | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by th… |
CVE-2026-21069 | High | 7.8 | 2026-08-10 | Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-55768 | | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the buil… |
CVE-2026-55123 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2026-50402 | High | 7.8 | 2026-07-14 | Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-53466 | Medium | 6.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-53133 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix truncation for block sizes >= 4G
When the iommu is used the linearization… |
CVE-2026-53923 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF de… |
CVE-2026-9143 | Low | 3.7 | 2026-06-19 | There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high… |
CVE-2026-24192 | High | 7.8 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between numeric types, leading to a heap buffer… |
CVE-2026-26178 | High | 8.8 | 2026-04-14 | Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-34945 | Medium | 6.5 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of… |
CVE-2026-24174 | High | 7.5 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful… |
CVE-2026-4931 | High | 8.6 | 2026-04-07 | Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost. |
CVE-2026-34610 | Medium | 5.9 | 2026-04-02 | The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extrac… |
CVE-2026-34550 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) cond… |
CVE-2026-34548 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) cond… |
CVE-2026-4602 | High | 7.5 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js… |
CVE-2026-27691 | Medium | 6.2 | 2026-02-25 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow i… |
CVE-2026-25989 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can… |
CVE-2026-24856 | High | 7.8 | 2026-01-28 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to… |
CVE-2025-71002 | Medium | 6.5 | 2026-01-28 | A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-21693 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21688 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21673 | High | 7.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXml… |
CVE-2025-10543 | Medium | 5.3 | 2025-12-02 | In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their le… |
CVE-2025-58063 | High | 7.1 | 2025-09-09 | CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerabil… |
CVE-2025-53733 | High | 8.4 | 2025-08-12 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24059 | High | 7.8 | 2025-03-11 | Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2024-49093 | High | 8.8 | 2024-12-12 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability |
CVE-2024-7747 | Medium | 6.5 | 2024-11-28 | The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This i… |
CVE-2024-38044 | High | 7.2 | 2024-07-09 | DHCP Server Service Remote Code Execution Vulnerability |
CVE-2024-32481 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `rang… |
CVE-2024-26162 | High | 8.8 | 2024-03-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2024-1552 | High | 7.5 | 2024-02-20 | Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices… |
CVE-2023-28063 | Medium | 6.7 | 2024-02-06 |
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit t… |
CVE-2023-46848 | High | 8.6 | 2023-11-03 | Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs… |
CVE-2023-5184 | High | 7.0 | 2023-09-27 | Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. |
CVE-2023-3635 | Medium | 5.9 | 2023-07-12 | GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when h… |
CVE-2023-20006 | High | 8.6 | 2023-06-28 | A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense… |
CVE-2023-29346 | High | 7.8 | 2023-06-14 | NTFS Elevation of Privilege Vulnerability |
CVE-2023-24884 | High | 8.8 | 2023-04-11 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability |
CVE-2023-0185 | Medium | 6.7 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may… |
CVE-2022-43663 | High | 8.1 | 2023-03-20 | An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2023-23401 | High | 7.8 | 2023-03-14 | Windows Media Remote Code Execution Vulnerability |
CVE-2023-23388 | High | 8.8 | 2023-03-14 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2023-21736 | High | 7.8 | 2023-01-10 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-34680 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, w… |
CVE-2022-34677 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be tr… |
CVE-2022-34670 | High | 7.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors w… |
CVE-2022-40225 | Medium | 6.5 | 2022-11-10 | A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4… |
CVE-2022-42324 | Medium | 5.5 | 2022-11-01 | Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the… |
CVE-2022-40138 | Critical | 9.8 | 2022-10-11 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bou… |
CVE-2022-36025 | Critical | 9.1 | 2022-09-24 | Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An e… |
CVE-2022-2639 | High | 7.8 | 2022-09-01 | An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a ne… |
CVE-2022-34169 | High | 7.5 | 2022-07-19 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java cl… |
CVE-2014-125012 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulati… |
CVE-2014-125011 | Medium | 5.3 | 2022-06-18 | A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function decode_frame of the file libavcode… |
CVE-2021-27478 | High | 8.2 | 2022-05-12 | A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service… |
CVE-2022-27189 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2022-0322 | Medium | 5.5 | 2022-03-25 | A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privileg… |
CVE-2022-27882 | High | 7.5 | 2022-03-25 | slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router a… |
CVE-2021-32996 | High | 7.5 | 2022-01-10 | The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required. |
CVE-2021-0964 | Medium | 6.5 | 2021-12-15 | In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information discl… |
CVE-2021-41272 | High | 7.5 | 2021-12-13 | Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the intr… |
CVE-2021-41202 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there i… |
CVE-2021-36357 | Critical | 9.8 | 2021-10-22 | An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, resulting in a type… |
CVE-2021-21861 | High | 8.8 | 2021-08-16 | An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. When pr… |
CVE-2021-21860 | High | 8.8 | 2021-08-16 | An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A speci… |
CVE-2021-37679 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` cal… |
CVE-2021-37669 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving mod… |
CVE-2021-37661 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_… |
CVE-2021-37646 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an… |
CVE-2021-37645 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is v… |
CVE-2021-38187 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64. |
CVE-2021-32461 | High | 7.8 | 2021-07-08 | Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Integer Truncation Privilege Escalation vulnerability which could allo… |
CVE-2021-23997 | High | 8.8 | 2021-06-24 | Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this cou… |
CVE-2021-32629 | High | 7.2 | 2021-05-24 | Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable mach… |
CVE-2021-29539 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.ImmutableConst`(https://www.tensorflow.org/api_docs/python/tf/raw_op… |
CVE-2020-28588 | Medium | 5.5 | 2021-05-10 | An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has… |
CVE-2020-15225 | High | 7.5 | 2021-04-29 | django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `Numb… |
CVE-2021-3444 | High | 7.8 | 2021-03-23 | The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker… |
CVE-2021-27219 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an im… |
CVE-2021-27218 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit pl… |
CVE-2020-13545 | High | 7.8 | 2021-01-06 | An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A speci… |
CVE-2020-13544 | High | 7.8 | 2021-01-06 | An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A speciall… |
CVE-2020-35926 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer t… |
CVE-2020-13985 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. A memory corruption vulnerability exists in the uIP TCP/IP stack component when handling RPL extension headers… |
CVE-2019-14563 | High | 7.8 | 2020-11-23 | Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2020-27194 | Medium | 5.5 | 2020-10-16 | An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values… |
CVE-2020-1913 | High | 8.1 | 2020-09-09 | An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause… |
CVE-2020-12417 | High | 8.8 | 2020-07-09 | Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitab… |