CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

PT-2026-89498

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

PT-2026-89512

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-74509

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Google Chrome and Chromium-based browsers, such as Microsoft Edge, are affected by a high-severity vulnerability caused by improper validation of an array index in the ANGLE component. A remote attacker can exploit this flaw via a crafted HTML page to potentially execute arbitrary code outside th...

Linux Distros Unpatched Vulnerability : CVE-2026-87500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the...

CVE-2026-87500: Improper Validation of Array Index

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

GHSA-2X7J-588G-CCC2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

NPM: multer vulnerable to Denial of Service via oversized array index in field names

NPM: multer vulnerable to Denial of Service via oversized array index in field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

EUVD-2026-67932

multer vulnerable to Denial of Service via oversized array index in field names...

CVE-2026-84942

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...