CVE-2026-105753

A flaw was found in vLLM. This vulnerability allows a remote user to cause a Denial of Service DoS on the model serving engine. The issue occurs when a multimodal request is rejected after media processing, causing the frontend and backend caches to become desynchronized. A subsequent request...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

EUVD-2026-92843

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

PT-2026-106742

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro rpc port. Attackers can send forged requests with the force flag set to bypa...

PT-2026-106730

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.get supported language variant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memo...

nginx

CVE-2017-7529 당승표@portfolio10 Summary This lab exercise reproduces the cache vulnerability CVE-2017-7529 that occurs during the Nginx server's Range request handling process, and the actual behavior of the vulnerability Vulnerability: Possible exposure of cached data due to an error in Nginx Rang...

EUVD-2026-92845

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on /score and /rerank...

CVE-2026-105755

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105756

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachesalt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the...

CVE-2026-105753

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

cve_2026_31431

CVE-2026-31431 "Copy Fail" Kit de herramientas Detector y LPE de prueba de concepto para el error de escritura temporal en la caché de páginas de Linux algifaead / authencesn divulgado el 2026-04-29. Divulgación del informe: https://xint.io/blog/copy-fail-linux-distributions Autorización Úselo...

Dnsrr

DNSrr DNSrr is a tool written in bash, used to enumerate all the juicy stuff from DNS records, it uses different techniques like DNS Forward Bruteforce DNS Reverse Bruteforce DNS Cache Snooping DNS Zone Transfer To get you all the information that you can get, from a DNS server. Installation...

DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

CVE-2026-105754

The vLLM inference and serving engine (prior to version 0.30.0 ) contains a vulnerability in the /inference/v1/generate endpoint within the disaggregated scale-out path. The root cause is that the system trusts caller-supplied features—specifically in the features.kwargs_data , features.mm_hashes...

CVE-2026-105753

The vLLM inference and serving engine is vulnerable to a shared-service availability failure in versions prior to 0.28.0 . The root cause is a desynchronization in the mirrored multimodal LRU cache ; if a request is rejected during multimodal rendering, the frontend sender cache commits a media h...

CVE-2026-105752

The vLLM inference and serving engine is vulnerable in versions prior to 0.30.0 due to a flaw in how Harmony tool continuations are handled via POST /v1/responses requests. The application fails to preserve the cache_salt value when rebuilding the next-turn engine input, causing the continuation ...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...