100318 matches found
CVE-2026-98840
A flaw was found in the Linux kernel's virtual console screen driver. A race condition between virtual console write operations and console deallocation can cause the kernel to access previously freed memory, resulting in a use-after-free vulnerability. A local user could exploit this flaw to cau...
CVE-2026-98762
A flaw was found in the Linux kernel's USB DWC2 driver. A race condition during host controller teardown or initialization failure allows the wakeup timer to execute after host resources have been released. A local user could exploit this use-after-free vulnerability to cause a Denial of Service...
CVE-2026-98800
A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed execution. A local user can exploit this race condition to...
CVE-2026-114055
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...
DEBIAN-CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114051
vLLM before 0.31.0 skips the mintokens = maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized...
CVE-2026-114094
Versions of Dulwich before 1.2.9 are vulnerable to an arbitrary file write on Windows due to a failure to validate DOS drive letter prefixes in Git tree path elements. An attacker can craft a malicious repository containing a tree entry named 'C:' , which bypasses NTFS validation . This allows th...
CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
CVE-2026-114055
Versions vLLM from 0.7.3 before 0.31.0 are vulnerable to an uncontrolled resource consumption flaw (CWE-400 ). The issue stems from unvalidated mm_processor_kwargs parameters supplied by remote clients. Attackers can manipulate values such as image size, patch count, crop count, or frame count in...
CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...
CVE-2026-114055
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...
CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...
CVE-2026-114051
The vLLM library (versions before 0.31.0 ) is vulnerable to a Denial of Service (DoS) condition. The flaw occurs because the system skips the min_tokens
CVE-2026-114051 vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
vLLM before 0.31.0 skips the mintokens = maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized...
EUVD-2026-107002
vLLM before 0.31.0 skips the mintokens = maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized...
CVE-2026-114051
vLLM before 0.31.0 skips the mintokens = maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized...
CVE-2026-114050
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...
EUVD-2026-106997
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...