EntropicaPublic

March updates I need to move some work over from the private repos. The exploration into using massivly multheaded models with mixer and readout functions separated continues. Currently training up a Chinese TinyStories on a 3B-equivalent model that trains, easily, on an 8GB gpu. We're looking at...

CVE-2025-14174-analysis

CVE-2025-14174 Analysis: ANGLE Metal Staging Buffer Out-of-Bounds Write Technical analysis and proof-of-concept for CVE-2025-14174 | ---|--- CVE| CVE-2025-14174 Severity| High Exploited ITW| Yes - targeted attacks on iOS 26 Affected| iOS Safari, macOS Chrome/Chromium/Electron not macOS Safari...

CVE-2026-115913

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...

CVE-2026-115913

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...

CVE-2026-116181

A flaw was found in vllm. An authenticated remote attacker could cause a Denial of Service DoS or memory corruption by submitting requests containing invalid stop token identifiers. Because the application does not verify whether provided stop tokens fall within the model's vocabulary range,...

Google Chrome buffer error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a buffer error vulnerability caused by GPU memory corruption. This vulnerability may allow remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

Google Chrome buffer error vulnerability

Google Chrome on Android versions prior to 156.0.8078.47 contain a buffer error vulnerability. This vulnerability stems from GPU memory corruption, allowing remote attackers to read memory within the sandbox through a specially crafted HTML page...

Google Chrome buffer error vulnerability

Versions of Google Chrome prior to 156.0.8078.47 contain a buffer overflow vulnerability caused by GPU memory corruption. This vulnerability could allow remote attackers to execute arbitrary code within a sandbox through a specially crafted HTML page...

PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

PT-2026-105921

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through media io kwargs.video.video backend, but engine GPU memory reservation is computed only from static startup configuration and VLLM VIDEO LOADER BACKEND. If the server starts with the default...

CVE-2026-47510

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an integer overflow leading to an out-of-bounds write to GPU memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation o...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyNvVideoCodecVideoBackendMixin, where sampler subclass shadowing causes independent...

CVE-2026-100649

A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service DoS by submitting video processing requests that specify different sampler subclasses. Because active decoder counters are tracked independently across subclasses rather than globally, requests can bypass...

CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

EUVD-2026-87743

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...

CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...