CVE-2026-110879

The jackson-databind library (com.fasterxml.jackson.core:jackson-databind from version 2.10.0 and tools.jackson.core:jackson-databind from version 3.0.0 ) contains a PolymorphicTypeValidator bypass. The vulnerability occurs because the library validates the outer class of a class-name type ID but...

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CLSA-2026-1787889621 jackson-databind: Fix of CVE-2026-54513

CVE-2026-54513: fix BasicPolymorphicTypeValidator allowIfSubTypeIsArray to validate array element type...

GHSA-8RW6-P7M8-63JP SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

A SELECT permission defined on an array element DEFINE FIELD field. … PERMISSIONS FOR select … is not enforced correctly for RECORD users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate keeps and...

CVE-2026-48517

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowedType as a safety check for dangerous types. The default implementation checks the outer type nam...

CVE-2026-48517: Use of Externally-Controlled Input to Select Classes or Code

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowedType as a safety check for dangerous types. The default implementation checks the outer type nam...

EUVD-2026-21402

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element...

CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OPNEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather...

CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OPNEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather...

CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OPNEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather...

CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OPNEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather...

EUVD-2022-4498

Malicious code in bioql PyPI...

BIT-TENSORFLOW-2021-29558 Heap buffer overflow in `SparseSplit`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.SparseSplit. This is because the...

CVE-2021-29558

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.SparseSplit. This is because the...

CVE-2017-14629

In sam2p 0.49.3, the inxpmreader function in inxpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element...

CVE-2015-5689

ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite GSS before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution DS before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code,...

CVE-2013-6639

The DehoistArrayIndex function in hydrogen-dehoist.cc aka hydrogen.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact via JavaScript code that sets the...

CVE-2013-6639

CVE-2013-6639 affects Google V8 (before 3.22.24.7) as used in Google Chrome before 31.0.1650.63. The DehoistArrayIndex function in hydrogen-dehoist.cc (hydrogen.cc) can trigger an out-of-bounds write via crafted array indices, potentially leading to a denial of service. The public records indicat...

UBUNTU-CVE-2013-2083

The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request...