5961 matches found
PT-2026-102450
Name of the Vulnerable Software and Affected Versions mwasikz robo-cafe-rms versions up to 228c44a02823f04e85db32b7137809a2856148fc Description A cross site scripting issue exists within the Edit Profile Feature in the file frontend/update-account.php. Remote exploitation is possible by...
CVE-2026-102264: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cros...
Improper Validation of Array Index
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via missing vocabulary-bound validation of stoptokenids in the Rust HTTP and gRPC frontends. When a request is...
PYSEC-2026-4185
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
CVE-2026-100652
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
PYSEC-2026-4185
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
CVE-2026-100652 vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
EUVD-2026-87746
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
CVE-2026-100652
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...
CVE-2026-100650 vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls the VLLMMAXAUDIOCLIPFILESIZEMB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits. Across four ingress paths — the shared...
CVE-2026-100650 vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls the VLLMMAXAUDIOCLIPFILESIZEMB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits. Across four ingress paths — the shared...
Malicious Package
Overview epic-comment-rating-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview epic-blog-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-95523
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95524
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95525
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
EUVD-2026-85494
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-95525 WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
