PYSEC-2026-3997

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

PYSEC-0000-CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

PYSEC-2026-3997

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93565 Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

CVE-2026-93565

A flaw was found in Netty RtspDecoder. The "RtspMethods.valueOf" function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling...

CVE-2026-93565 Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

CVE-2026-93565

CVE-2026-93565 affects Netty's netty-codec-http module , specifically the RtspMethods.valueOf() method used by RtspDecoder. The root cause is that valueOf() silently strips trailing control bytes (code point ≤ 0x20) before performing a cache lookup against its ten pre-populated method constants. ...

CVE-2026-93565

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

EUVD-2026-82911

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. An unauthenticated attacker can send a single request containing a negative token ID , triggering a CUDA device-side assertion that poisons the GPU context and causes all subseq...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2024-30804

ASUS 드라이버 LPE PoC 물리 메모리 남용 이것은 AsInsHelp64.sys 드라이버를 악용하는 로컬 권한 상승LPE PoC입니다. 합법적이고 서명된 ASUS 드라이버를 남용하여 물리 메모리를 매핑하고 커널 토큰을 덮어쓰며, 궁극적으로 NT AUTHORITY\SYSTEM 권한을 획득합니다. 🎯 취약점 정보 대상 : AsInsHelp64.sys ASUS 팬 Xpert v.10013 미만 관련 기법 : 임의 물리 메모리 읽기/쓰기 근본 원인 : 드라이버는 모든 사용자가 물리 메모리를 가상 주소 공간에 매핑할 수 있는...

grafana: Grafana: Temporary access control bypass for service account token minting

A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...

CVE-2026-87965

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...

CVE-2026-87965

The Easy Appointments WordPress plugin (versions before 4.0.2.2 ) is vulnerable to unauthenticated appointment cancellation and confirmation. The root cause is the use of guessable tokens for mail-link actions, as the plugin derives these tokens from a hardcoded source-embedded salt and the appoi...

CVE-2026-87965 Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...

CVE-2026-87965 Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...