CVE-2025-71203

CVE-2025-71203 concerns the Linux kernel where a user-controlled syscall number could be used to index the syscall table, enabling potential data leakage via cache side channels. The mitigation is to clamp the index with array_index_nospec() after the bounds check to prevent speculative out-of-bo...

CVE-2025-71203: Improper Validation of Array Index

In the Linux kernel, the following vulnerability has been resolved: riscv: Sanitize syscall table indexing under speculation The syscall number is a user-controlled value used to index into the syscall table. Use arrayindexnospec to clamp this value after the bounds check to prevent speculative...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the GetSUCI function when processing a crafted 5GS Mobile Identity in a NAS Registration Request message. An attacker can cause a crash of the AMF component by sending a specially crafted message...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via improper validation of multibyte character length in text manipulation. An attacker can execute arbitrary code as the operating system user running the database by issuing specially crafted queries...

Amazon Linux 2 : rsync, --advisory ALAS2-2026-3157 (ALAS-2026-3157)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3157 advisory. A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a...

CVE-2026-25518: Improper Validation of Array Index

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the tplgdecodecontrolmixer1 function when the numchannels field from untrusted .tplg data is used as a loop bound without validation against the fixed-size channel array. An attacker can cause...

The vulnerability of the DSP-service of microprogramming software in embedded chips from Qualcomm allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the DSP-service of microprogramming software in embedded chips from Qualcomm arises from incorrect validation of the array index. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the indexadd function. An attacker can cause the application to crash or become unresponsive by submitting specially crafted input. Remediation There is no fixed version for oneflow. References -...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the flow.cuda.synchronize function when it is called with an invalid or out-of-range GPU device index. An attacker can cause the application to crash or become unresponsive by supplying a malicious...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the flow.cuda.getdeviceproperties function. An attacker can cause the application to crash or become unresponsive by supplying an invalid or negative device index. Remediation There is no fixed...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via improper validation in the flow.cuda.getdevicecapability function. An attacker can cause the application to crash or become unresponsive by supplying a specially crafted device ID. Remediation Ther...

OESA-2026-1174 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

OESA-2026-1175 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

OESA-2026-1176 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

OESA-2026-1172 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000960)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000960 advisory. Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when CONFIGHIDMULTITOUCH is...

CVE-2026-0529

Improper Validation of Array Index CWE-129 in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers CAPEC-100 through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002062)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002062 advisory. Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11 allow physically proximate attacke...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002421 advisory. Array index error in the logidjrawevent function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute...