CVE-2021-3156

CVE-2021-3156 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single backslash character. Credit to: Advisory by Baron Samedit of Qualys How to...

SUSE CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2026-115916

A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting a request containing an out-of-bounds pre-tokenized prompt token identifier. Due to an off-by-one error in input validation, an invalid token identifier equal to the vocabulary siz...

CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

EUVD-2026-110036

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

PT-2026-123448

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max token id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

Security Bulletin: IBM MQ Appliance is affected by an off-by-one buffer overflow vulnerability (CVE-2026-12727)

Summary IBM MQ Appliance has addressed an off-by-one buffer overflow vulnerability that could allow an authenticated attacker to cause potential process instability when processing specially crafted object names. Vulnerability Details CVEID:CVE-2026-12727 DESCRIPTION: IBM MQ could allow an...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan (CVE-2026-12413)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan, due to an invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Libreswan is used in our Speech runtimes. This vulnerability has been addressed. Please read the...

CVE-2026-98675

A flaw was found in the Linux kernel's Analog Devices ADE9000 driver. An off-by-one error in the interrupt handler sets an incorrect upper bound when scanning device status events. Consequently, the driver fails to detect and report Phase C power dip events to the operating system, preventing...

Atlassian Confluence 7.2.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104511)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104511 advisory. - Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rul...

CVE-2026-93166

A flaw was found in the wifi: rtw89 driver of the Linux kernel. An off-by-one error in the rtw89ppdustr function, due to an incorrect comparison, can lead to an out-of-bounds access. This vulnerability could potentially result in a denial of service or information disclosure...

CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwlmvmfrobtxfkeyiter function, responsible for sanitizing transmit TXF keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being...

Atlassian Jira Service Management Data Center and Server 3.3.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16798)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16798 advisory. - Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes...

DoS (Denial of Service) org.apache.tomcat:tomcat-catalina Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.tomcat:tomcat-catalina Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 7.2.0, 7.3.1, 7.4.0, 7.5.0, 7.6.0, 7.7.2, 7.8.0, 7.9.0, 7.11.0, 7.12.0, 7.13.0, 7.14.0, 7.15.0, 7.16.0, 7.17.0, 7.18.0, 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, 8.9.0, 9.0.1,...

CVE-2026-108443

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

EUVD-2026-102455

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: e1000/e1000e: Fixed a leak in DMA error cleanup If an error occurs while mapping TX buffers, the driver should unmap any buffers that have already been mapped for that skb. Since the counter is incremented after a successful...