CVE-2021-48020

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48020 Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48020

Vyper versions 0.1.0b4 before 0.3.0 are vulnerable to a memory corruption issue (CWE-787) triggered by an incorrect stack tip pointer . This occurs when internal function calls are performed within arrays . Specifically, contracts that place internal calls in nested array elements, external call ...

EUVD-2021-34890

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48020

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

EUVD-2020-31284

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

CVE-2020-37286

Vyper versions 0.1.0b4 before 0.3.0 are vulnerable to a memory corruption issue caused by an incorrect stack tip pointer . This occurs when internal function calls are nested within tuples or other nested calls. Consequently, contracts using these calls as tuple elements, call arguments, or as ar...

CVE-2020-37286 Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

PT-2026-120157

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

PT-2026-120161

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw log topics can...

CVE-2026-46614 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/ and /fission-function// — for every Function object,...

CVE-2025-52293

The GPAC MP4Box v2.4 multimedia packager contains a segmentation violation in the gf_hevc_read_sps_bs_internal function located in the media_tools/av_parsers.c file. This vulnerability is caused by uncontrolled resource consumption when processing specially crafted HEVC Sequence Parameter Set (SP...

Improper Access Control

Fission is vulnerable to improper access control. The vulnerability is due to the router automatically registering internal function routes without validating associated HTTPTrigger restrictions, which allows an attacker to invoke arbitrary functions directly by guessing the function name and...

CVE-2026-8336

After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine through $where, $function, mapreduce reduce stage, etc. is used also in...

Improper Access Control.

Vite is vulnerable to improper access control. The vulnerability is due to missing Origin header validation in the WebSocket connection path, which allows an attacker to invoke internal functions and retrieve arbitrary server files via crafted WebSocket requests...

CVE-2026-3697 Planet ICG-2510 Language Package Configuration httpd sub_40C8E4 stack-based overflow

A vulnerability was determined in Planet ICG-2510 1.020250811. The impacted element is the function sub40C8E4 of the file /usr/sbin/httpd of the component Language Package Configuration Handler. Executing a manipulation of the argument Language can lead to stack-based buffer overflow. The attack...

Tassos Framework Access Control Vulnerability

Tassos Framework is a development framework created by Tassos Marinos. The Tassos Framework has a security vulnerability related to access control. This vulnerability arises from insufficient restrictions during the processing of certain AJAX requests, which may lead to improper invocation of...

libjpeg-turbo Heap Buffer Overflow DoS

The vulnerability of the h2v2mergedupsampleinternal function in the libjpeg-turbo library is related to writing beyond buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

Bluspark BLUVOYIX security vulnerabilities

Bluspark BLUVOYIX is a digital supply chain management platform from US-based Bluspark, Inc. A security vulnerability exists in Bluspark BLUVOYIX that stems from the exposure of sensitive internal API documentation, which could lead to an attacker abusing internal functionality to compromise the...

CVE-2025-66648

A flaw was found in vega-functions. For sites that allow users to supply untrusted input, a remote attacker could exploit a vulnerability by maliciously using an internal function. This could lead to the execution of unintentional JavaScript, resulting in Cross-Site Scripting XSS. Mitigation...