223 matches found
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
Summary The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. Details When a form is submitted to a remote functi...
PT-2025-54216
Name of the Vulnerable Software and Affected Versions Serverless Framework versions 4.29.0 through 4.29.2 Description The Serverless Framework includes a command injection issue within the built-in MCP server package @serverless/mcp. This affects users utilizing the experimental MCP server featur...
BIT-NGINX-GATEWAY-2024-24990 NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...
CVE-2025-60455
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...
Modular Max Serve has Unsafe Deserialization vulnerability
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...
Deserialization of Untrusted Data
Overview modular is an A suite of AI libraries and tools that accelerates model serving and provides programmability all the way to the GPU kernels Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the kvcacheagent process when the...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via libmicrohttpdws.so when building with the --enable-experimental option. An attacker can cause the application to crash by sending malicious network traffic. Workaround Users are advised to avoid using the...
EUVD-2024-19507
Malicious code in bioql PyPI...
EUVD-2024-19501
Malicious code in bioql PyPI...
EUVD-2023-34963
Malicious code in bioql PyPI...
EUVD-2023-34965
Malicious code in bioql PyPI...
EUVD-2023-43062
Malicious code in bioql PyPI...
EUVD-2023-34967
Malicious code in bioql PyPI...
EUVD-2024-22352
Malicious code in bioql PyPI...
EUVD-2023-36802
Malicious code in bioql PyPI...
EUVD-2023-44930
Malicious code in bioql PyPI...
EUVD-2023-36290
Malicious code in bioql PyPI...
EUVD-2023-36294
Malicious code in bioql PyPI...
EUVD-2023-34962
Malicious code in bioql PyPI...
CVE-2025-10148
curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...