25427 matches found
wasm3:fuzzer: Index-out-of-bounds in Pop
Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5433814251012096 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: Pop...
ROS-20260113-7316
Vulnerability of astudcgetstatus function in drivers/usb/gadget/udc/aspeedudc.c module of usb gadget driver of Linux kernel is related to incorrect index calculation. Exploitation of the vulnerability may allow an intruder to affect confidentiality, integrity and availability of protected...
ROS-20260113-7312
A vulnerability in the navi10issupportfinegraineddpm function in the drivers/gpu/drm/amd/pm/swsmu/smu11/navi10ppt.c module of the amdpgu driver of the Linux kernel is related to incorrect index calculation. Exploitation of the vulnerability may allow an intruder to affect confidentiality, integri...
CVE-2025-71100: Improper Validation of Array Index
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cutxfilldesc TID getting from ieee80211gettid might be out of range of array size of staentry-tids, so check TID is less than MAXTIDCOUNT. Othwerwise, UBSAN warn: UBSAN:...
Webgrind 跨站脚本漏洞
Webgrind is a web-based PHP performance analysis tool from the individual developer Joakim Nygård. A cross-site scripting vulnerability exists in Webgrind 1.1 and earlier versions, which stems from insufficiently encoded user input in the file parameter of index.php, and could lead to a reflectiv...
PT-2026-2429
Name of the Vulnerable Software and Affected Versions Webgrind version 1.1 Description Webgrind version 1.1 contains a remote command execution issue. Unauthenticated attackers can inject OS commands through the dataFile parameter in the ''index.php'' file. Attackers can execute arbitrary system...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the use of the wrong array index in rosekillbydevice, which could lead to an out-of-bounds read...
GuardDog 路径遍历漏洞
GuardDog is a CLI tool in GuardDog open source that allows identifying malicious PyPI packages. A path traversal vulnerability exists in GuardDog versions prior to 2.7.1, which stems from the presence of path traversal in the safeextract function, which could lead to arbitrary file overwriting an...
The vulnerability of the zipfile module in the CPython interpreter allows attackers to compromise the integrity of protected information.
The vulnerability of the zipfile module in the CPython interpreter is related to incorrect checking of specified indices, positions, or offsets in input data. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information...
PT-2026-2632
Name of the Vulnerable Software and Affected Versions Metricbeat affected versions not specified Description The software contains flaws related to improper validation of array indices and improper input validation. These issues can be exploited through specially crafted, malformed payloads sent ...
MiracleLinux 7 : udisks2-2.8.4-1.0.1.el7.AXS7 (AXSA:2025-11447:04)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11447:04 advisory. CVE-2025-8067: fix issue allowing unprivileged users to create loop devices with negative index values CVEs: CVE-2025-8067 A flaw was found in the Udisks...
Elastic Metricbeat 安全漏洞
Elastic Metricbeat is a metrics collector from the Dutch company Elastic. A security vulnerability exists in Elastic Metricbeat that stems from improper array index validation and insufficient input validation, which could lead to a denial of service by an attacker via specially crafted malformed...
3m (>=0.1.0, <=0.1.3), aap-llamaindex (>=0.1.1.dev1, <=0.2.0) +357 more potentially affected by CVE-2024-14021 via llama-index (>=0.4.17, <=0.14.25)
llama-index PYPI version =0.4.17, =0.1.0, =0.1.1.dev1, =0.1.8, =0.0.2, =1.1.0a20250502, =0.10.0, =1.4.3, =0.1.0a0.dev0, =0.2.0a0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-14021 Source advisory: SNYK:PYTHON-LLAMAINDEX-14917171...
Deserialization of Untrusted Data
Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the loadfromdisk function. An attacker can execute arbitrary code by supplying a crafted multiembedstore.pkl file in a user-controlled director...
Deserialization of Untrusted Data
Overview llama-index-indices-managed-bge-m3 is a LlamaIndex Indices Integration: Bge-M3 Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the loadfromdisk function. An attacker can execute arbitrary code by supplying a crafted multiembedstore.pkl file in a...
3m (>=0.1.0, <=0.1.3), aap-llamaindex (>=0.1.1.dev1, <=0.2.0) +357 more potentially affected by CVE-2024-58339 via llama-index (>=0.4.17, <=0.14.25)
llama-index PYPI version =0.4.17, =0.1.0, =0.1.1.dev1, =0.1.8, =0.0.2, =1.1.0a20250502, =0.10.0, =1.4.3, =0.1.0a0.dev0, =0.2.0a0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-58339 Source advisory: SNYK:PYTHON-LLAMAINDEX-14917160...
PYSEC-2026-85
LlamaIndex run-llama/llamaindex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.loadfromdisk in llamaindex/indices/managed/bgem3/base.py. The function uses pickle.load to deserialize multiembedstore.pkl from a user-supplied persistdir without...
CVE-2024-58339
LlamaIndex run-llama/llamaindex versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The customquery logic generates SQL statements from a user-supplied prompt and executes them via vn.runsql without...
