LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

Summary LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data. With ownPropertyOnly: true, direct access such as: liquid a0 correctly blocks an inherited array index. However, the same inherited value is still disclosed...

Vyper: Return inside for loop more than 1 level deep

VVE-2020-0002 Earlier today, we received a responsible disclosure of a potential issue from @michwill developer of @curvefi for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction...

GHSA-VG88-3V92-RJX2 Vyper: Return inside for loop more than 1 level deep

VVE-2020-0002 Earlier today, we received a responsible disclosure of a potential issue from @michwill developer of @curvefi for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to unbounded next-action-time search in the schedule spec evaluation logic in service/worker/scheduler/spec.go and the scheduler/frontend list-matching-time paths. An authenticated caller with...

SUSE CVE-2026-72488

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via unchecked input for the loop condition in the System.Net.WebSockets. An attacker can cause a denial of service by sending specially crafted network requests that trigger excessive resource...

veraPDF Parser DoS via PostScript CMap Streams

Summary Description A PostScript-interpreter-driven Denial of Service CWE-1325 vulnerability in veraPDF allows a remote attacker to exhaust validator memory or CPU by submitting a PDF whose Type 0 font /Encoding or any /ToUnicode is a CMap stream containing attacker-supplied PostScript. veraPDF...

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

GHSA-C3JM-9VJ7-5V66 Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

EUVD-2022-0283

Malicious code in bioql PyPI...

EUVD-2023-35749

Malicious code in bioql PyPI...

EUVD-2022-55337

Malicious code in bioql PyPI...

SUSE CVE-2022-50066

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...

DEBIAN-CVE-2022-50066

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...

UBUNTU-CVE-2022-50066

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...

CVE-2022-50066 net: atlantic: fix aq_vec index out of range error

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...

SUSE CVE-2025-37942

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

kernel: pmdomain: imx8mp-blk-ctrl: add missing loop break condition

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mpblkctrlremove will continue the for loop until an out-of-bounds exception occurs. pstate: 60000005 nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=-- pc :...

CVE-2025-27104

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

GHSA-H33Q-MHMP-8P67 Vyper has a double eval in For List Iter

Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable updated in the loop body and thus lead to unexpected progra...