nvidia-gpu-security-poc

NVIDIA GPU driver — two findings NVIDIA closed as expected behavior Proof-of-concept code and raw evidence for two findings in the NVIDIA Linux GPU driver, both reported through NVIDIA's VDP and both closed by NVIDIA as intended/expected behavior. Published so the behaviour is documented and...

The vulnerability in the `include/linux/filter.h` and `kernel/bpf/core.c` files of Linux operating systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the include/linux/filter.h and kernel/bpf/core.c files of Linux operating systems is related to a violation of expected behavior. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the arch/x86/include/asm/nospec-branch.h and arch/x86/kernel/cpu/bugs.c files in Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the arch/x86/include/asm/nospec-branch.h and arch/x86/kernel/cpu/bugs.c files in Linux operating systems is related to a violation of expected behavior. Exploiting this vulnerability can allow an attacker to cause a service failure...

AZL-105612 CVE-2026-35191 affecting package openvmm 0.1.0-1

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

EUVD-2026-89002

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

QUIC Unvalidated Amplification Credit may be Over Accounted

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

Expected Behavior Violation

Overview Affected versions of this package are vulnerable to Expected Behavior Violation via the PFCP Association Setup Request process. An attacker can cause service disruption and trigger reconnection loops by sending a malformed request that is incorrectly accepted, resulting in an inconsisten...

The vulnerability of the WatchGuard Fireware operating system, related to the violation of expected behavior, allows attackers to circumvent security restrictions.

The vulnerability of the WatchGuard Fireware operating system is related to a violation of expected behavior. Exploiting this vulnerability can allow an attacker to circumvent security restrictions...

EUVD-2025-201299

An Expected Behavior Violation CWE-440 vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the...

CVE-2025-13940: Expected Behavior Violation

An Expected Behavior Violation CWE-440 vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the...

PT-2025-49164

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.8.1 through 12.11.4 WatchGuard Fireware OS versions 2025.1 through 2025.1.2 Description A flaw exists within the Fireware OS that could allow an attacker to circumvent the boot time system integrity check. Th...

EUVD-2025-6104

Malicious code in bioql PyPI...

EUVD-2024-22167

Malicious code in bioql PyPI...

The vulnerability of the cJSON.c component in the JSON-object handling library for C allows a attacker to cause a service failure.

The vulnerability of the cJSON.c component in the JSON-object handling library for C is related to a violation of expected behavior. Exploiting this vulnerability can allow an attacker to cause a service failure...

Expected Behavior Violation

Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Expected Behavior Violation via the DocugamiReader class. An attacker can cause loss of important document content, disrupt parent-child chunk hierarchies, and lead to inaccurate AI...

Security Bulletin: AIX/VIOS is vulnerable to an expected behavior violation (CVE-2025-32728) due to OpenSSH

Summary AIX's OpenSSH DisableForwarding directive does not adhere to the documentation CVE-2025-32728. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2025-32728 DESCRIPTION: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the...

CVE-2025-46712: Expected Behavior Violation

Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...

CVE-2025-32728: Expected Behavior Violation

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding...

OESA-2025-1290 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, fr...

OESA-2025-1289 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, fr...