CVE-2026-80627 MIPS: mm: Fix out-of-bounds write in maar_res_walk()

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

CVE-2026-80609

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-80598

CVE-2026-80598 is an out-of-bounds read in the Linux kernel's ntfs3 filesystem, specifically in the decompress_lznt() function. The root cause is a missing array index bounds validation before accessing the decompression table; a corrupted NTFS3 image with invalid compressed data can trigger the ...

CLSA-2026-1787889621 jackson-databind: Fix of CVE-2026-54513

CVE-2026-54513: fix BasicPolymorphicTypeValidator allowIfSubTypeIsArray to validate array element type...

PT-2026-115009

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.136.0 through 0.148.0 Description An unauthenticated remote client can trigger a deterministic nil-pointer panic during request validation. This occurs when an OpenAPI 3.1 array schema omits the items keyword, which is...

CVE-2026-82333: Uncontrolled Resource Consumption

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

MapServer Unverified Array Indexing DoS

The vulnerability of the MapServer geographic data rendering system is related to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-83111

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259: Deserialization of Untrusted Data

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82254: Uncaught Exception

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

PT-2026-83367

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032284 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the...

PT-2026-83023

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs during boot when the fdt scan reserved mem function processes dynamically-placed /reserved-memory subnodes. The function saves these subnodes into a local...

CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-81528

CVE-2026-81528 affects the MongoDB C# driver , where the document-replacement code path omits the element-name/shape validation applied by equivalent write paths. This allows NoSQL injection : an application passing untrusted, loosely-typed input as a replacement value can have that input interpr...

NoSQL injection via array replacement bypassing update shape validation in driver write path

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

CVE-2026-81528 NoSQL injection via array replacement bypassing update shape validation in driver write path

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

CVE-2026-81528 NoSQL injection via array replacement bypassing update shape validation in driver write path

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

CVE-2026-81334

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...