CWE-704 Incorrect Type Conversion or Cast

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

node-tar: Process crash via PAX numeric path type confusion

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

cert-manager-controller DoS via Specially Crafted DNS Response

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

loggingredactor converts non-string types to string types in logs

Improperly checked metadata on tools/armour itemstacks received from the client

Exposure of Sensitive Information to an Unauthorized Actor in nanoid

Mattermost Incorrect Type Conversion or Cast

Duplicate Advisory: AWS Redshift JDBC Driver fails to validate class type during object instantiation

Incorrect Privilege Assignment in Jenkins Script Security Plugin

pg-native and libpq vulnerable to uncontrolled resource consumption

Weaviate denial of service vulnerability

os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`

Unsound casting in flatbuffers

Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder

crack does not properly restrict casts of string values