Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via unvalidated stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoint...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via missing vocabulary-bound validation of stoptokenids in the Rust HTTP and gRPC frontends. When a request is...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the array filter, which is registered without the necessary sandboxing guard. An attacker can access sensitive...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100668

Grav versions 2.0.0 through 2.0.24 are vulnerable to a Twig content sandbox escape due to the array filter being registered without the necessary needs_is_sandboxed guard. This allows an attacker capable of authoring Twig content to evaluate grav|array to access the raw Pimple-based dependency in...

EUVD-2026-87762

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

DEBIAN-CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-98153

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98153 nvme: fix racy access to FDP placement id array

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98153

The Linux kernel contains a race condition in the nvme driver related to the FDP placement id array . The function nvme_query_fdp_info() is called per-path, allowing two concurrent paths scanning the same namespace to race when populating head->nr_plids and head->plids for FDP registration....

CVE-2026-97930

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

CVE-2026-97611

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

CVE-2026-97611

The Linux kernel contains a use-after-free vulnerability in the Open vSwitch component involving the flow table mask array. The issue exists in tbl_mask_array_realloc(), where call_rcu() is invoked to retire the old mask_array before it is no longer reachable. Because the pointer swap with rcu_as...

EUVD-2026-86742

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

CVE-2026-97611 net: openvswitch: fix use-after-free of the flow table mask array

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...