CWE-129 Improper Validation of Array Index

SFTPGo: Denial of service via malformed SSH channel request

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

Vyper: Memory corruption using function calls within tuples / nested calls

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

GoBGP confederation validation panics on empty AS_PATH attribute

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define