CWE-682 Incorrect Calculation

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

New API: Integer overflow in quota billing yields negative charges (self-crediting)

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

validateSignature Loop Variable Capture Signature Bypass in goxmldsig

libcrux-sha3: Incorrect output from SHAKE squeeze functions

CIRCL has an incorrect calculation in secp384r1 CombinedMult

ml-dsa's UseHint function has off by two error when r0 equals zero

soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method

Cranelift vulnerable to miscompilation of constant values in division on AArch64

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

Vyper's sqrt doesn't define rounding behavior

Erroneous Proof of Work calculation in geth

Shallow copy bug in geth

Vyper's `_abi_decode` input not validated in complex expressions

missing clamps for decimal args in external functions

Segfault due to negative splits in `SplitV`

Weight not properly refunded after EVM execution

Frontier's modexp precompile is slow for even modulus

evmos allows transferring unvested tokens after delegations