13710 matches found
CVE-2026-79623 FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The...
CVE-2026-79623 FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The...
CVE-2026-79623 FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The...
PYSEC-2026-4003
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684
vLLM versions prior to 0.27.0 are susceptible to a denial-of-service condition through improper handling of the DeepStream backend. The root cause is a failure to classify DeepStream as a GPU backend combined with missing pixel-limit enforcement in the decode path. An unauthenticated attacker can...
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-49263
A flaw was found in Capstone, a disassembly framework, affecting its WebAssembly WASM backend. A remote attacker could exploit this by providing a specially crafted brtable instruction. This could lead to a denial of service, where the disassembler gets stuck in a loop, or cause parser...
CVE-2026-49282
A flaw was found in Capstone. The csinsnname application programming interface API in the M68K and RISCV backends does not properly validate caller-supplied instruction IDs. An attacker can provide an invalid instruction ID, leading to an out-of-bounds read. This can cause the process to crash,...
libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison
A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...
CVE-2026-77129
CVE-2026-77129 is a Server-Side Template Injection (SSTI) in the TYPO3 extension Event management and registration (sf_event_mgt). The extension passes an editor-configurable email subject string directly into a Fluid template source without sanitization. A backend user with edit access to the ev...
CVE-2026-77129
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...
CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...
EUVD-2026-65339
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...
CVE-2026-77137
CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...
CVE-2026-77137
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...
